Overview

overview

10

Static

static

3

2026-07-31...ck.exe

windows10-2004-x64

10

2026-07-31...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/07/2026, 19:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
  • Size 1.6MB
  • Sample260731-x755jsfm21
  • SHA256 abfbe6646e021c88dc153791b8c317207e879f9c524c4b6a519f2dc0126ebb86
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 61 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 61 IoCs
    defense_evasiontrojan
  • Renames multiple (125) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 60 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5664
    • C:\Users\Admin\DacIcYMI\PEIIYQwU.exe
      "C:\Users\Admin\DacIcYMI\PEIIYQwU.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:1204
      • C:\ProgramData\aGcMkIIU\fQUQkoso.exe
        "C:\ProgramData\aGcMkIIU\fQUQkoso.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        PID:4612
    • C:\ProgramData\aGcMkIIU\fQUQkoso.exe
      "C:\ProgramData\aGcMkIIU\fQUQkoso.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of FindShellTrayWindow
      PID:4448
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1804
      • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1392
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5076
          • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5204
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:3380
              • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2248
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5980
                  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:2520
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:5960
                      • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:2928
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1200
                          • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:2760
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2708
                              • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                15⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:2256
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1820
                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:4588
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:3420
                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                        19⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2320
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                          20⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:5656
                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                            21⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5496
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                              22⤵
                                                PID:3304
                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                  23⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4200
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                    24⤵
                                                    • Executes a command shell one-liner
                                                    PID:5100
                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                      25⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5308
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                        26⤵
                                                          PID:3284
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                            27⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:3468
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                              28⤵
                                                                PID:3644
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                  29⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:3864
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                    30⤵
                                                                    • Executes a command shell one-liner
                                                                    PID:2252
                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                      31⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:3252
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                        32⤵
                                                                        • Executes a command shell one-liner
                                                                        PID:1356
                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                          33⤵
                                                                            PID:4128
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                              34⤵
                                                                                PID:5584
                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                  35⤵
                                                                                    PID:992
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                      36⤵
                                                                                      • Executes a command shell one-liner
                                                                                      PID:3376
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                        37⤵
                                                                                          PID:948
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                            38⤵
                                                                                              PID:2276
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                39⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:4880
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                  40⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  PID:1172
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                    41⤵
                                                                                                      PID:200
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                        42⤵
                                                                                                          PID:1720
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                            43⤵
                                                                                                              PID:5312
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                44⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:2492
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                  45⤵
                                                                                                                    PID:5200
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                      46⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      PID:3148
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                        47⤵
                                                                                                                          PID:2984
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                            48⤵
                                                                                                                            • Executes a command shell one-liner
                                                                                                                            PID:1260
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                              49⤵
                                                                                                                                PID:4888
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                  50⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:6096
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                    51⤵
                                                                                                                                      PID:5588
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                        52⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:5404
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                          53⤵
                                                                                                                                            PID:3348
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                              54⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:4388
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                55⤵
                                                                                                                                                  PID:2072
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                    56⤵
                                                                                                                                                      PID:5804
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                        57⤵
                                                                                                                                                          PID:924
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                            58⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:2820
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                              59⤵
                                                                                                                                                                PID:5492
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                  60⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:5116
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                    61⤵
                                                                                                                                                                      PID:4924
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                        62⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:5820
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                          63⤵
                                                                                                                                                                            PID:4932
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                              64⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:1224
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                65⤵
                                                                                                                                                                                  PID:1812
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                    66⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:5780
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                      67⤵
                                                                                                                                                                                        PID:2744
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                          68⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:2616
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                            69⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:4264
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                              70⤵
                                                                                                                                                                                                PID:3520
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                  71⤵
                                                                                                                                                                                                    PID:4460
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:2996
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                        73⤵
                                                                                                                                                                                                          PID:4680
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                            74⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:1408
                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                              75⤵
                                                                                                                                                                                                                PID:3032
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                75⤵
                                                                                                                                                                                                                  PID:4720
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                    76⤵
                                                                                                                                                                                                                      PID:912
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                        77⤵
                                                                                                                                                                                                                          PID:3384
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                            78⤵
                                                                                                                                                                                                                              PID:364
                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                79⤵
                                                                                                                                                                                                                                  PID:5660
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                  79⤵
                                                                                                                                                                                                                                    PID:5772
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                      80⤵
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:5956
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                        81⤵
                                                                                                                                                                                                                                          PID:2180
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                              PID:1060
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                83⤵
                                                                                                                                                                                                                                                  PID:3884
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                      PID:3152
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                        85⤵
                                                                                                                                                                                                                                                          PID:4420
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                            86⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            PID:2356
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                              87⤵
                                                                                                                                                                                                                                                                PID:1900
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                    PID:1304
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                      89⤵
                                                                                                                                                                                                                                                                        PID:3168
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          PID:4524
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                                                                                              PID:4184
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                92⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                PID:4952
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                                                                                                    PID:1100
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                                                                                                        PID:4620
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                                                                                                            PID:2828
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                                                                                PID:5360
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                                                                                                    PID:3860
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      PID:256
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:5672
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                                                                                                            PID:4084
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                                                                                                                PID:1592
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  PID:268
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                                                                                                      PID:2948
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                                                                                                        PID:1716
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:2796
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                                                                                                              PID:3220
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                PID:4984
                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                                                                                                    PID:5844
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                                                                                                      PID:2940
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                                                                                                          PID:868
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                                                                                                                              PID:5760
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4512
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                                                                                                                      PID:3176
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5444
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1144
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:3200
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2480
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4712
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:3024
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:1376
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:3084
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4364
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4848
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:3104
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5112
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                PID:4560
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1092
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1948
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1972
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5620
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1784
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                      121⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TokIcQYQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2144
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                        121⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2500
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5512
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1364
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1236
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LsgMMokw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                          119⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2172
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1980
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1644
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3272
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\igsswYYc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3296
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2956
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3548
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2144
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4156
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3668
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:8
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sSEQUIYY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5724
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1948
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3964
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6108
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3776
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4792
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:832
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gwYUsUsI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5412
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4636
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1940
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4896
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1284
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1228
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4728
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LYUYQIUk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2972
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4364
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2644
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2500
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\daYYgkII.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5860
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3016
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lYsYwYgw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1236
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4364
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3392
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lGcYgQww.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1140
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4792
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2932
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wAkIIAIQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5736
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3888
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2848
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1288
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:804
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qcMccIUU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5544
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2500
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3276
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vwsMwoAM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2812
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3256
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1228
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XAQEMgMw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5744
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3552
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5760
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2612
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4712
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NygUcoEA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3592
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3296
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4636
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2348
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2848
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GUIAUUQQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2440
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5388
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3668
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2468
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iIoIwwgk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3412
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4708
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          88⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1236
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                            89⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3496
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3436
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              88⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1940
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yqkMAIco.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1980
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            86⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4244
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            86⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1592
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              86⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2800
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JAIMEgoo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              86⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2948
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          84⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                            85⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1956
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            84⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                            84⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2580
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PcQIAAIM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                            84⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5256
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5864
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1336
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1644
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3188
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZgQoYMQE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          80⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                          80⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:6004
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EcwQkcAE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3276
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2800
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5392
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\esMYAwYs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2684
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                              79⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                          76⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5512
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\siwgwsos.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                          76⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2524
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                            77⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4156
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3084
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5752
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yoocwIoU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2704
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                        75⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5436
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                  72⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                  72⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3552
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                    72⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4372
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RGEQEgsg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                    72⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                      73⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5744
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                PID:3176
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                PID:1132
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                PID:1428
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VgEMQEYw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:236
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                  71⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2028
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                    71⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5104
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                              68⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                              PID:3548
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                              68⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4756
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                68⤵
                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                PID:2468
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rSogQUAY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                68⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  69⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2612
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:5844
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:3024
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                              66⤵
                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:3308
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qagQoUEk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                              66⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2716
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  67⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4728
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            64⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            PID:3412
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            64⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:8
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                              64⤵
                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                              PID:5724
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uaMEMQEU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                              64⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              PID:5164
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                65⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                PID:3032
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                          62⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                          PID:6108
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                          62⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:2684
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:3200
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wwkgkIgE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:3452
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                              63⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:3244
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                63⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                PID:4524
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          PID:1632
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5436
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            60⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:3504
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BUUEAwgc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            60⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            PID:1460
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                              61⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:4460
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                        PID:2480
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:2444
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                        PID:1876
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZSwoAYYk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4296
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                            59⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:3188
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                      56⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                      PID:5388
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                        57⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:2352
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                        56⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                        PID:1960
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                        56⤵
                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                        PID:5956
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hskYQUoE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                        56⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:3076
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                            57⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                            PID:2404
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                      PID:2348
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:3244
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                      PID:5672
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SwMkcQgU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      PID:1276
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                        55⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                        PID:5164
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                  PID:4636
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4864
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                    52⤵
                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:2356
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yqgsgUkc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                    52⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:1316
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                      53⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                      PID:4144
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                50⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                PID:5676
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                50⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2828
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  50⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  PID:2616
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IKEMYEIM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                  50⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:2576
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                    51⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                    PID:2684
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              48⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              PID:5512
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                              48⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2192
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                48⤵
                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                PID:4712
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DCggogok.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                48⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:4176
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                  49⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                  PID:1140
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                            46⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                            PID:3012
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                            46⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                            PID:4184
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            46⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            PID:5724
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TSgMgIIw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            46⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:2360
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                              47⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                              PID:4288
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                        44⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:3152
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                          45⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4908
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5796
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            44⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            PID:912
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QgIsgYAo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            44⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:2788
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                              45⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                              PID:1688
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                        42⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:2028
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                        42⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3272
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                          42⤵
                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                          PID:1364
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DggAkkoo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                          42⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          PID:4532
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                            43⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                            PID:4792
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                      40⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                      PID:4160
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                      40⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4908
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        40⤵
                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                        PID:5672
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hmQIgYgs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                        40⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:2564
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                          41⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                          PID:4516
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                    38⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                    PID:3392
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                    38⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:3496
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                      PID:2716
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uEUUYwgg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:6016
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                        39⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                        PID:2828
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                  36⤵
                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                  PID:1260
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                  36⤵
                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                  PID:1900
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                  36⤵
                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:2180
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\beAgYkgI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                  36⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2332
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                      37⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:5660
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                34⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:2564
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                34⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4372
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                  34⤵
                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                  PID:2192
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pMcMIIAY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                  34⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                  PID:5408
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                    35⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                    PID:2576
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                              32⤵
                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                              PID:4932
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                              32⤵
                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                              PID:2956
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                              32⤵
                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                              PID:3504
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tWkYocss.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                              32⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:4780
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                33⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                PID:3152
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                          30⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                          PID:3392
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                          30⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5096
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                            30⤵
                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                            PID:3496
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HyMYAcoo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                            30⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                            PID:3448
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                              31⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                              PID:1428
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                        28⤵
                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                        PID:1500
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                        28⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4296
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                          28⤵
                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                          PID:3020
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mOsUoYUQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                          28⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:440
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                            29⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                            PID:5360
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                      26⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                      PID:1640
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                      26⤵
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                      PID:8
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                      26⤵
                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                      PID:5112
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uEUwAIcw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                      26⤵
                                                                                                                                                                                                                                                                                                                                                        PID:2884
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                          27⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                          PID:1712
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                    24⤵
                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                    PID:5116
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                    24⤵
                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                    PID:2484
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                    24⤵
                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                    PID:4364
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iyQwwYss.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                    24⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:2336
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                      25⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                      PID:1632
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                22⤵
                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                PID:1844
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                22⤵
                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                PID:2796
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                22⤵
                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                PID:5808
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VUEYYwsc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                22⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1788
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                    23⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                    PID:5436
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                              PID:1604
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                                                                                                                PID:3888
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                20⤵
                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                PID:708
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fUsIAEIM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                20⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1636
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                    21⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                    PID:3776
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                              18⤵
                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                              PID:1696
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                              18⤵
                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                              PID:5620
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                              18⤵
                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                              PID:2352
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RiUIEwMk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                              18⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:3628
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                19⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                PID:4652
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                          PID:5776
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                                                                              PID:4400
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                                                                                                              PID:5796
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                              16⤵
                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                              PID:3020
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\esEwAoUw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                              16⤵
                                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                              PID:5320
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                17⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                PID:4556
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                          PID:4788
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                          PID:4288
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:5112
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qqwUAwcw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                          PID:1136
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                            PID:5456
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                      PID:2604
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                        PID:3884
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                        PID:4512
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CsEUEQwk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                        PID:3632
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                          PID:5824
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                    PID:1172
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                    PID:4868
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                    PID:4720
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XKEEYQkI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                    PID:5652
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                      PID:3680
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                PID:1956
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                PID:2360
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                PID:5412
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NeMkkYUY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                PID:2364
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                  PID:4372
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                            PID:2900
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                              PID:2352
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                              PID:2704
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\piYMMcUY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                              PID:4576
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                PID:4228
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                          PID:4360
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                          PID:2324
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                          PID:4400
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pqYsgcYw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                          PID:1436
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                            PID:4920
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                      PID:4996
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:1832
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                        PID:2504
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gQUMgMMs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                        PID:1320
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                          PID:6052
                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\zsQAIkwI\xkcYYAUc.exe
                                                                                                                                                                                                                                                                                                                      C:\ProgramData\zsQAIkwI\xkcYYAUc.exe
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                      PID:376
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\DacIcYMI\PEIIYQwU.exe
                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\DacIcYMI\PEIIYQwU.exe
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:4812
                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\aGcMkIIU\fQUQkoso.exe
                                                                                                                                                                                                                                                                                                                      C:\ProgramData\aGcMkIIU\fQUQkoso.exe
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                      PID:2864

                                                                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                          Reconnaissance

                                                                                                                                                                                                                                                                                                                          Resource Development

                                                                                                                                                                                                                                                                                                                          Initial Access

                                                                                                                                                                                                                                                                                                                          Execution

                                                                                                                                                                                                                                                                                                                          Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                          T1059

                                                                                                                                                                                                                                                                                                                          Visual Basic

                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                          T1059.005

                                                                                                                                                                                                                                                                                                                          Windows Command Shell

                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                          T1059.003

                                                                                                                                                                                                                                                                                                                          Persistence

                                                                                                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                                                                                                          Privilege Escalation

                                                                                                                                                                                                                                                                                                                          Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                          T1548

                                                                                                                                                                                                                                                                                                                          Bypass User Account Control

                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                          T1548.002

                                                                                                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                                                                                                                                                          Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                          T1548

                                                                                                                                                                                                                                                                                                                          Bypass User Account Control

                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                          T1548.002

                                                                                                                                                                                                                                                                                                                          Hide Artifacts

                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                          T1564

                                                                                                                                                                                                                                                                                                                          Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                          T1564.001

                                                                                                                                                                                                                                                                                                                          Impair Defenses

                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                          T1562

                                                                                                                                                                                                                                                                                                                          Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                          T1562.001

                                                                                                                                                                                                                                                                                                                          Modify Registry

                                                                                                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                                                                                                          T1112

                                                                                                                                                                                                                                                                                                                          Credential Access

                                                                                                                                                                                                                                                                                                                          Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                          T1555

                                                                                                                                                                                                                                                                                                                          Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                          T1555.003

                                                                                                                                                                                                                                                                                                                          Unsecured Credentials

                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                          T1552

                                                                                                                                                                                                                                                                                                                          Credentials In Files

                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                          T1552.001

                                                                                                                                                                                                                                                                                                                          Discovery

                                                                                                                                                                                                                                                                                                                          System Information Discovery

                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                          T1082

                                                                                                                                                                                                                                                                                                                          System Location Discovery

                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                          T1614

                                                                                                                                                                                                                                                                                                                          System Language Discovery

                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                          T1614.001

                                                                                                                                                                                                                                                                                                                          Lateral Movement

                                                                                                                                                                                                                                                                                                                          Collection

                                                                                                                                                                                                                                                                                                                          Data from Local System

                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                          T1005

                                                                                                                                                                                                                                                                                                                          Command and Control

                                                                                                                                                                                                                                                                                                                          Exfiltration

                                                                                                                                                                                                                                                                                                                          Impact

                                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                                          fQUQkoso.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 74d5ad2dbb15ea5315376555f6c9f7d2b49cae52ae6364a8fec5b281121b68ec
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 08393955e9db2d8e3df64ba223e3ea45771ef93188c471d8a6df2d7e1f2831ef
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 0db99b0f06427a5ac48f3afc4d54544485516ce80789c940d7de7c1f5dc59cf7
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 bef943abb7bb727359215557a4c491521d7926ae9bd555f82e22c5bd35d07126
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 d2d7ec40381a53c0ed9120718708ee8a4a2741a24e32ae65eb0ff0ad31c2166e
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 1346e3bf205b26cb1c826c163d268b586d86a3140e3ec64ac15e1069395e2b76
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 2391fec60dfae9835de8f6aed7c4f7ec8943b13fa1c0394460cee49283ce0c05
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 d29cb1d74a19e3b32962a3509f19d5aa9c37fbccc2bf4aea6c4693481269a1e4
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 9a4d15aea72f3ae33e2207d54434881d46e113a32b6483956c404c18bfb8d061
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 1cf95b1a657fb612aa5221fdf2e19e1e4f4279271dfbccb609cfa8546b81b3cf
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 b1daef41f642c0e4d6cbd99b379f89d0c8985f1f37c1cdf40142c73a29b3216a
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 5fbfdd911b0f1b4147fd89f2e7ee37b6fd2bb127c634d7eefbfa068fc86dbfb5
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 299fab3076b89791e2af220ce8217cd15944f2b76001a3d8682fad528f1564a3
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 9a29e09326182419a80e7757e9685c0ed862eb3d547dda3031717838b41474d2
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 465f02964a5a0ff593e306a269641e13aafa55b6b5179fdf83da8814415ffb0f
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 7151875ac3edc097f4ffc5291f9cd6113f92164353cfddf6ca19476c73d09fc9
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 41a87f39c9168d436b13e473908a7004aff359afd92834a11c8614f5aacf6fb3
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 cfb050b549b4021bdab0a657a0a20c579129430a16725397f4f364588853fd54
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 9ece409de50af5c7b5823c61a0b5fe0bfadbc6e0e45fcfffedd4316b219ff194
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 509c38b7683ad852186b6e11c1e048ed07ae4616b187857edad5a3776e09ad4c
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 a8638054b964250e41864cddafcc684bd6d9a79410298465a7a962122aeb93a6
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 c3bd2a13a295c8dc1df42bdf1acf2dfa911a4f5a85d9cc0b9527f8b6d03135e3
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 8167f3692e63efafbe7df33795725e2d8b83315fb4d56832f425a269119e6411
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 7590de978b987eb5015a98fcf52fb15b054aac7b169557cfb3ec7d59c4054279
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 12c5616edd2d602002af9b02fa8340d4c4a8683fe18189025d5b32c12dc0ea44
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 5f9d41d9d45e8f58e9dccb0fc76423679b4280105ec0b927b4e8a28f7480e6a9
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 e24a7a3c00eb8e3937e64189555e9e873bcd9cde2b74ab9ef47d3ff58d5560cf
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 6ab1a3b85cb0b90ca3ff7a4751f1b4628f23673d8ff605c70b87839469f363ce
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 e74b89c4b329347171d52ee44fe7f47f5028f708b8e5880d48d0b9e1ee122a11
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 2b5bd78b2327328292abcc6e4132fd449052d794b9b43ca81a822afd89a81375
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 fc7dc4d863705e49b867409b2930d3bdb6d778b65f594bf7820f7f0d78f710b6
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 4a9bb3e9daf8a72410ebd07d380b04eb8bb939605b989c20e1f3ecf56b4eefac
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 d56c7d37f94c43820794925ed4fa789e8ae0eb8bcda5507c874497f03c163176
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 0f5dfc1c97894de87fb6cb1cf8b0007e03e8e0b3f4022ffd5e7499f333ed1a5a
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 2591ffc35dd104e8c0dbf63f0fea57529fd298c76defd2192e7b959dad2afd0e
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 0e72d053e404a4182a1205102d83200539b81339bc3a85567c4557b210c8d0a4
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 eecbf72963d13ca1af8ba9b128eb4ae66f7c368f83bc74757f2084517fcbc752
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 f2b079e220bf8355a0b9ebd2a67caaf6a7abc35eed4a06e00640e8b47d5b8939
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 0208f0e731d3b4d3aa732bb90e09035f53254c5f5fd9754956087b4fe3e9fa1f
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 fa212e1bc632f031e224c20bf4ef309d72141cdaa9cd544b79a099a5cfde1471
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 212dd2efdc2543038dc9fe41b999d72d09549ffde705583b727f19f71d70fb3f
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 c304f4aaa1ffb580335bb31711a48d1c5ca749155a39cc3da9fe073f8119d08f
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 47efa1c55aaf2dd889c5a027ef1e8ccbc898b082b878da2a5e77a2669ea0555f
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 a1d1bfbdac549d1b2a7747cc7aac229c7456dd796a376800b0d5c86ac13b72aa
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 efd621bdf6fe5e67c4dbeb032436b6c42f3d48cfdd79b2d1eccf417979ef72ea
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 fb6badff58754c1fc0930aa431f5bf65a8fffe396d9e26655ed250701f8e9121
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 9a2a0386d930fc4b2fb4928ee274dc9e6cf8dda5973b9939fba965ee9200e07a
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 ab1b83b1f9c604cdbc3ad538310f7b6663ed80797f4a5af69b842ce1c011a409
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 b81be453488dea17873df5366928d8c8d7cd925a24ed5de9f8129b2dc55ba74f
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 f9e6e102734a5c7975f0eb3b58f0fd8a35cfd52330ce8043d71af62426e23b7a
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 1e99dd15ae0a5fb2470e7c559885c5f2e3a960f82eb1b2efa6328699f12266ce
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 192244a8aeb9ff9e0eb11bd21c41e7d32e6f6c6601e19f7504233d3cb64681b4
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 eabab26b924055f585a66c40165277f781c69e325f1c5c8cac5b30fd5e2b719a
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 53b39ed57b5707c8479055f92e13d7f43512d24191de683710ee97075b4159b0
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 08a0d998c30c468a10c9fe0f9c8e8354ab1fa795a60ed933202d8ba490d6bdf6
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 588c89295215fe30b0707cb59bec1a92b0fc1f4d34d31098a47d456586f3512c
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 9f9c1c95dac8f3c3a5ffbfaf9fc684805af81e6ff64eb82bd11c8eccefbae6d8
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 2d171236aa7c66e74f8432307ef9887aaaa79de83680725f9e400f3a1680ab3d
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 4af776a955078c3ec391a99b7587bbcd71cb97c072b7749de299872846aa21a5
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 0c743b5d8b89e99d9ecbeffd4285d12904877a50bde9376fec6ec26ad3eabd77
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 7e093565c88ddda78c9001fb054a7dc8df656f5ff4e3e2c2c2f4da0695c92caf
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 bcc4c601795d20b69b5e51dcc18fe984933036dd349d13b306f5357732c68fd1
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 18253f1fa40d4ff402c1d53de445aff6c424f36a6f8360c34b2a4d619774ca47
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 705b8b9a48cb637dfeab6946ff6046491a89dc78ab4295e9838213ee1ba7775a
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 a4ca1e91ac12a8523db4a9d0feb9651022ac4dd74a2ce4bba9828d0e7261575a
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 64332522ee665a4ed76588fe9859df141b819ce3166d0fe5a38ef070dc085298
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 ede28c72750149484d5bda3e7b5c6735430f3aa1fc79b147d2accc1306b7432a
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 223a2ea9c4b5235e7667253a021a3355aa145f8e2e3e09025b38a201db61d3f3
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 09fe7a9a13c949e7e7b56140629194f7dd15aedb43092f1dcbf1568ea05478f2
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 222b63cc8827abca3dae10f3bc9e3b6370ede71902f062a585968166e5296126
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 a1604b14f48421490deafcb0574640f27e4d465f35cedacf7210b6e044a3402f
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 a6831e990208323aaae4299680a67dc31d01a365f0dfd64e1d46e69a756d38ef
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 706c28149286617c01c13a966f8827520197bbf765a4d4b80e040bebf0e34b46
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 3f88866a2e5ab39a0e4bc787a559b4323ec6e000fa2834c535c2f295cb262827
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 6b9e0a783591009dc8ab5a8836484defebbe2fbd0f103c4bea636d11ee487019
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 187416dc4d938b790b599ace2d4f41922303f4271c2492f43261a6d4b980c0f9
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 c159dba354c240a8cfa87bea5822a53ef854879df44e516b2ae6f1a79529ac47
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 943b95511169968b4fd5b76beb248ade82a3f78bf9ec58f0b61820507bf0905b
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 b2be12528c9e9bc0208b70c40563c776177e636b35002ad9c74e8413297f12fa
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 1a4245c0d7c44f162767b55d9a0af4b7efd671b045a55a6d10039ab456be44b9
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 224ae0b0877d8711390d97749a511dc2054478ea3a3fa9bbd895f96a457ddf97
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 60ba83e9f032a9a240fe815b198c8165178f3292022d98dc374629c4af58dce1
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 fccc45d2bc45c4bbd669356bb06319513c0c928f58900c1ccb4c2075497e4c1b
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 021f9d51ddd31aba6709c30480f5e4287c0b7857ec9b988df0430ad644172b88
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 5598117acdc42be4856de9d622099472af97cfeaf38399602ecd616904c0d678
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 46431e78c56f2a19bb961a97969cc652fe2ddc976f5bb47fbd50ca116e85da57
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 9a0eced9a8c242cc220c47b6a4846c505061fecde2b2ac9a7c6b3e32050299ae
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 f48e28c655942ca74eaa1956f6bf18e3cb36393988258a554af773ab103c1132
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 88e0b3dc3887ecebe22f69e20afe6cc3b18c4bef850bddebb278fdd57287754a
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 3b71204c39c584cc6ee069b0ea6ad83dd88e2b0641015339563ff5d1c08fb6d3
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 031d63534f9992f9ada0b83ef7871b18d1581c2ff5536646e2db03b3f550e415
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 314cdff88c5ff68f5f1b71554a6631ca5c810151e93800c68b018a23dbf30318
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 a4a2ae98d608b5702953343bde8b7440b103aa3c387f95f862298bd39280c6a1
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 66282182d0c13840d5e7c4f442d9a580f0370917514e85c3d62b6733a7899100
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 22fd16be669d8d0c3e422bfc1f857cf67a2f9f7b9664a4a522ad1f0ea26044f0
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 6152109b92c63084781ef3b9e5775362845756047d89e9f4447259d31d5948d3
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 cdbaccf4f8a94822f85510d530c9b2fdf02ee46b41cda8413abe8ebd734603a5
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 d0439596e795ace7f601963a8df989209467db67564de6a7a9eb07ffb31fb7c4
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 801d8aa589deca9a3ddd31f6fafa564b2c197bb28acf05c980d24e5e9f168048
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 0a990e337b414a2877746ec2bb07e69963957d4277549f0205eba5f4636313a6
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 f5b2fe8ebf1ed38a9e3b352b627878bb33061c572bfd0e81d9e2ba2f5ce1ff96
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 68daa80abe93ff4a05cc32e28688f9deb1770531415abead598603212d123700
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 92b27810e683723c47988818b0950b9bbc5c36753bbc70ab4217483dc8aadff0
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 96afda7764bb3f0e5841c22bad75141d9324b0d6bdf8366ce71244e46fdf14b0
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 e7442a06198860facfa5a3804373ebc324d099e385372d98e6f65abd06bd56a0
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 9b86fb6cf715c7aeff96bef06c396c32e427d95b8102984ecc8d264462e3d9b1
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 33e0a180fc595c1c375a5e9aa9381b5c3ec43fbee34dd1770cc0ed6b106ceac6
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 8f05d5faade233466cf3f7d78c572a6d7ae11fd65c3764e5b4e3275d22175190
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 1ff513da5fef8918147398162b812b97cf0fa124241cb148e193c844723899d0
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 3a301a580748080f930947cec5be5bb0a65420f78fcb965a4d55a49861530449
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\aGcMkIIU\fQUQkoso.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 f140d47f60800aad98def503beb70990033e57c0d693c5a3609692c7ecd66bb6
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          vsYo.txt
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\vsYo.txt
                                                                                                                                                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                                                                                                                                                          • SHA256 c56d839221d79822462865490e9d186577c218389049400db8fee8de12256848
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          xkcYYAUc.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\zsQAIkwI\xkcYYAUc.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 aea0e6951595d4728db262485cf774df6b7a830b2d16827de7e636db106c5a7a
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                                                                                                                                          • SHA256 7d4cb603017c3703ff18e7c015375f87a8f130b65338bd31ef81caf8f7b8628a
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          AMIg.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\AMIg.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 8c1e11c209e9f4e13ad083aa558b7a24ef0c00a2e062c4f701a82875cde32302
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          AMUm.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\AMUm.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 6b2d1fea7a5054dd32834659e2b968540c34e352f43aaf64d2ff001692f01963
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          AQQg.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\AQQg.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 071867d87985ac6847a9ce26b04503158a923d7d658ef2c59f28e5b0993fffa1
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          ASwo.ico
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ASwo.ico
                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                          • SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          AUYO.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\AUYO.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 c0e7a0f5ed4b062cbe80fe1c73ae8a556860ea3718c6c50b9be8fbc845334efd
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          AYIo.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\AYIo.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 00373b3f5ac7e07bbb09e897e2f7c22e071303199be7ac3bf83a44ee09349d91
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          AasE.ico
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\AasE.ico
                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                          • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          AgAm.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\AgAm.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                          • SHA256 4f1c47c6f920f502c73701d1d68f4ef95fb9b891e412f0b4a15b8619c3787a53
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          AoQC.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\AoQC.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.2MB
                                                                                                                                                                                                                                                                                                                          • SHA256 ac5e433e7716af4cfb0a20e2b46426999efa09f6047687a395a0f4c69ed7213e
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          AoUM.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\AoUM.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 237c0e5d45052e679639193dcce59668307c392572ae9a0399102a5158f426c8
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          CAUw.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\CAUw.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 3def63d3a08f8bc346b7786feade91719d3ecbd70b52ffd9190bc9a55b8243d7
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          CAcM.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\CAcM.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 d558e4d92a3da4f5d8ac6d4dd15d8e1d56b086e6d119a7940c49fba10124ad63
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          CMAU.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\CMAU.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                                                                          • SHA256 3362fb6c506c4ce2b98f79048a1be382eebc24d1fe590d6033786d17d5da23f6
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          CUgo.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\CUgo.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.3MB
                                                                                                                                                                                                                                                                                                                          • SHA256 6fc05cde68e7c89def9fa6a0e096c303f1d22b580119201d9693f6aeee2b03be
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          CUoa.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\CUoa.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 bad4e3a30401b2160049259f212531dd2530ce5066f79ea3df258c7aff01fd88
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          CkcW.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\CkcW.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 f92794e2d3112a473e73042d3e2a61e3d9947de38fd431ddadde5d6a53692918
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          Ckgo.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Ckgo.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 3d1bd25ec95e9ab2e4321b1d4aef5b7895fe750a91558160c160526a58896e78
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          Coka.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Coka.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 3148c2c8110333bcf3ad32718b87439045028ba402b48ee263bf2b32d7a25d9e
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          Cska.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Cska.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                                                                          • SHA256 40d94da82566f6b30d7dc1b1fa4a89ccba094a2cae5fc68521d44f59c2d50a95
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          EAYg.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\EAYg.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 75f1fe2d9af49a42d41135e477311709f91c19edf27af0f750cb89dc1b28212f
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          EAwU.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\EAwU.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.2MB
                                                                                                                                                                                                                                                                                                                          • SHA256 278aa95b61aae0872fa75d2e461ed20bf3d3a248217c99edc5bb490bbfe75e54
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          EEUU.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\EEUU.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                                                                          • SHA256 fc528625a1d19a2e1be89e7ba239986f3f46e6ec7bd71f0021034bca429a47ec
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          EQAO.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\EQAO.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                          • SHA256 7178c77195ee221164480436e9a834d48510ce48d05d2c3e9751d001a0c0c5a6
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          EQsA.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\EQsA.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 11edbce5abccae859515c77a166f203408c7cf09f504d31708708c03a2fc76ce
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          Egso.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Egso.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.2MB
                                                                                                                                                                                                                                                                                                                          • SHA256 f2608d1f63e153e97a8301d8ecd3fcf577e365cfa57410d83bace0c658a5ef41
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          EoMm.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\EoMm.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 eec389492288b5c4e2c466d08d3e83c10fb88e1c6d37cad64c2325babed04dcb
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          GAYW.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\GAYW.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 245588a1e9a36582656e4b80279fbceaaad4e70a53c7c92e96fb2e207c1007ee
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          GEQo.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\GEQo.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.2MB
                                                                                                                                                                                                                                                                                                                          • SHA256 001a3d62a4584748153beac287c352c0e3521fd6baf549946060fc02f3ed9c96
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          GIwu.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\GIwu.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                          • SHA256 8beea84cb9702509e1f8986ffa9a70137bd00d245d7662316d7871a76f219dee
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          GQou.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\GQou.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                                                                          • SHA256 08735b66114b313fadd299df5da69cf79babf4c1075e52778274e66eb4b6d6da
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          GYUw.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\GYUw.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                          • SHA256 c0b2a6d516e4da51e350d257caaddb10d4dd1d29f768be0b70194208c4a69e37
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          GYYw.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\GYYw.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 77527406252815e5c0249ac5bacdefc1c2e4970d0d5bc20853fb7610904f7a75
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          GkkI.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\GkkI.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 12c1a7d31d1a156cdaf07f4cd87d22118ec311efe21cda00b6ff51c6091b4558
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          IEgC.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\IEgC.exe
                                                                                                                                                                                                                                                                                                                          • Size 3.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 76801a780216693568d3078049e6e26868307b28d5d8aa180cd046c02c96fb2a
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          IQQc.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\IQQc.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 721d01bad55ce3d6a4d410c6916d4ed3d583f063338571352c1482e3d02234d9
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          IUoC.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\IUoC.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                          • SHA256 744fd17a3a095f63f2bd72d57d52308876f8d9a96fd3e971cc0b98ad0134e234
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          IssE.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\IssE.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.1MB
                                                                                                                                                                                                                                                                                                                          • SHA256 d6968291232e80be6a9ff8d5e2d871aa1971f206116f5199d8bb73a690b8633d
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          IswE.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\IswE.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                          • SHA256 442e2d75eb7e58c3fb75ab7fa722535930c66d18a6f1f6e4774cce6dc16a1107
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          IwMO.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\IwMO.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                          • SHA256 6563518435ee1bf4b424ff4b37159097ac03872577a9b462e1704626fcd72d3c
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          KMso.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\KMso.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 d37b39616deba212c8ee622e9ae2ad00d824e3d44d93715e8cb5326651afcbd8
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          KUYi.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\KUYi.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.2MB
                                                                                                                                                                                                                                                                                                                          • SHA256 6a6a5bb3aeffa54213965bda77bb7022c3b0d1d34ba68bb7312ecf9533de7cd5
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          Kcoc.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Kcoc.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                                                                          • SHA256 2f0573c4adba5d5db7bfa313b343cf9e18d49df10c325512980f3c23d1cf6d3b
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          KkEy.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\KkEy.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.5MB
                                                                                                                                                                                                                                                                                                                          • SHA256 4217e5730414973ebfd2a5ab5b987c51526330c332e4cd1ec8a940ddfb0780f4
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          KkgC.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\KkgC.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 d875ab24f3af14870b936399164a6128d17183d0f33bd33f7f4f44a9dcdfaa66
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          KoEA.ico
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\KoEA.ico
                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                          • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          KwcA.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\KwcA.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                          • SHA256 19cebe576cea5f1e4e6ddb5b776f45b8642c4bee86f37edb2cbc6c1453757f32
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          MIcY.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MIcY.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 af0bacc80055269a692e17b3eeb7ba0a657c66bcaf5b5768a5ab27eb6c962e6b
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          MQMg.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MQMg.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.5MB
                                                                                                                                                                                                                                                                                                                          • SHA256 78079daff2ea448e0abcbb44eca84f033dbea32a072a4d19fd43523e729a4ae2
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          MUYs.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MUYs.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.1MB
                                                                                                                                                                                                                                                                                                                          • SHA256 da5f9a0bf0452551991a8def8faf7bd0a1163eb9aac74e7da6cb9cc5fc4938a1
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          MoEe.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MoEe.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 ff09d5e3841d5924ac7ab47c464e22ea9b9604805af6813dd52bb21373d4e2a9
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          Moss.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Moss.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 f4a5ab058094c2515063869b5e789c18593c41fd019322749062a3effdab02ce
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          OIQU.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\OIQU.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 d4f1ba4657cb5dfea567d0694f46c9a90d9a92e501f7da2d868c73efc197de3a
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          OIcC.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\OIcC.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 089a6293742196e8449dd8078a66553cdda67999f42defed0eb02fb7cd506543
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          Ocgs.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Ocgs.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                          • SHA256 c224080954e2604868b0474ae72f08d0c8a0b5f41270fd81a2aa7fd2bb0445f0
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          OkUm.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\OkUm.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 0f91dd49dc50898754a4b358ee4ad3c541b898198fc34cab94a7f87b9a584486
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          QYYC.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\QYYC.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 6a14c2b8aad29418a4d76ee24a6370272eab68f01a4048b8b912e3c4e5d29cbd
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          QccW.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\QccW.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 e7a5120a7e8b421455faf89f9e8e333d4e95763ba08f1662f45159c20543fcb1
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          QgAM.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\QgAM.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                                                                          • SHA256 f91761b69d7587aa48bd9e13750c5a8f3cedea6f85c87f49b42f8ae4b72746e7
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          QkUo.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\QkUo.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 b3d26182088223ccd3f0da436d41cdd74971118e10f55bd712503901ddb635a5
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          QqEc.ico
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\QqEc.ico
                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                          • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          SAQA.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\SAQA.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                                                                          • SHA256 aee8cbef732b4518ab529baeaa8eefa6e13a9ff97667d19ea714abb9f993343f
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          Skkg.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Skkg.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                          • SHA256 eabdb7c344dca1927ae3a609590a9f2fac606bd81d4ccf1940660186d978e343
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          SsUk.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\SsUk.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 39a82946221714cd1e6696f699e75fc6a6e63a9a822a0a94e8d73b355ec26e5b
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          UMIw.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\UMIw.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 ef92ec6529dde48e03859d6c1285343d321a3c112b04daf9e202fbaff18b7d1a
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          UMgg.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\UMgg.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 d97d3593319e1fc8c14385cf4bc1e7048f2d1a9a6c618ee6ec7d81dc578838a7
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          UMkQ.ico
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\UMkQ.ico
                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                          • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          UQMy.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\UQMy.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                          • SHA256 360a4f0e6286ba92fccea6a97042424e57627afcab20bb24e6a0251c3e6c6dc8
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          UQYw.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\UQYw.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 86e3a64ace259c709a6d7a68e500d78339397955913dc3b068f06ac28fe61bcb
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          UYgG.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\UYgG.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 025160e43ae2f569473fb7f4e9eb054e5550f4b6bc93153189d1308c1b51830c
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          Uccw.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Uccw.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 dce61f1463dae9087e25e6aebfcbb72c0e2af0cf87d3595ab2149890c04af825
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          UgcK.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\UgcK.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 c71528abd5ec67b00eac9692ad3ea1d97bc4643672d268dba36e26ba9b811c65
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          UgoA.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\UgoA.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 dc69d13b338c725bdfacd535fcf678445766e617170a05c1572ae60d130d1b45
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          UoAk.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\UoAk.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                          • SHA256 283bff0fac3aec403615ac1f02ff7c0db3f5ee55c8804f512c0285691d7fe61f
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          Uowi.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Uowi.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.9MB
                                                                                                                                                                                                                                                                                                                          • SHA256 9f7329df2312e65ffed47e836dac6fbcab6cc6851b23724cf1d0351337d76833
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          WIoC.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\WIoC.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 db28dfc859690a291995ae7a4dff9b520ff48de4cd3e164c5bc5bcba7f90442b
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          WMIG.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\WMIG.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.2MB
                                                                                                                                                                                                                                                                                                                          • SHA256 926aa9d6fcc7fadee728d046b15f3d6a38feb01892195193cd4e0e8b562ec04a
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          WUIu.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\WUIu.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 d548556a02b66231eccc11df853ab263320b4a24b29ca2006b4f5f70e6a1a092
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          WUoG.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\WUoG.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                          • SHA256 86c05aae314283a23446658a6747c97052cb948f94f1c0ec35f0119f10687a5f
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          WkUi.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\WkUi.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                          • SHA256 9f20f896a243f06e03d4963b73daeb6840fce413dc67e28f62df87e130e08973
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          WsAw.ico
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\WsAw.ico
                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                          • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          WsQg.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\WsQg.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 1756cb2cc26e5412b76daf95234932d6b00ba744d65dd14b01e904aeb1cdcf4a
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          WwkW.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\WwkW.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                          • SHA256 5ef6511b48dcf1b25ef28ab40ca96267112821ee5f0d6c40e6e2438ac0967699
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          YAEM.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\YAEM.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 0b61dbbfa0171e06a691ffe9ff240563a0661b6b525103079eefc5fee2b99913
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          YAkK.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\YAkK.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                                                                          • SHA256 8c3235bab8127c32d54b32f09e081a805a9067fb96f46277d75fd16ac012f520
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          YEEs.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\YEEs.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.2MB
                                                                                                                                                                                                                                                                                                                          • SHA256 cd6faf7828f93a454080c2252a48ddfb45a93d7cad4049f9df835683f010e360
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          YYMo.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\YYMo.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 ac146d64c5b96f811132c149541f2e9f6743da92c7f01ed370e66040c75242f7
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          YgQm.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\YgQm.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.2MB
                                                                                                                                                                                                                                                                                                                          • SHA256 ba75de629c878b4b684a925baa90312928e3c7d8761fca096d009f419b566fbc
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          YuEo.ico
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\YuEo.ico
                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                          • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          aAIM.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\aAIM.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 337f0910c384d2ec772a609d9a6e6e2279119af73e14195cf861ff45f90a1015
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          aAsI.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\aAsI.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                          • SHA256 cf2106a449243117c5bea61649ca33e25d8c438832081d37c8621229d605e79a
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          aEEa.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\aEEa.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                                                                          • SHA256 0c535003af3a21afc91543da497565e624e8e162637262a1875be631aef277ea
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          aIAC.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\aIAC.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 0a9523dfe2ed259851ab6d64d9cba34885b01b5c6a84298c6cd314f7f7f7a5be
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          aUcG.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\aUcG.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.4MB
                                                                                                                                                                                                                                                                                                                          • SHA256 fe3edc55e97c30765b02aa0ed486c075b0693c77df15597857bb14dbb3cc11fd
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          askK.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\askK.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 6d9d64a63a6ddaff89746951edd6f6bdd388144a7af026841bc63367fa68713e
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          awMa.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\awMa.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 f200f2025b64ef06f8ecef3c6d05cbdb7b9337018775ec25c8f2fc63c9f8f9d8
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          cAMI.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\cAMI.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.3MB
                                                                                                                                                                                                                                                                                                                          • SHA256 0437a293a8e5ed602a2944963cdfe6efe139470bf1a10b0b399691675971fd18
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          cMIu.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\cMIu.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                          • SHA256 abc94b60530107564b502532f3319772abc6e715895b6ae3f405103d16d60e37
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          cMUK.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\cMUK.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 06b6544cf0fb7aca7950bf3191e70c96c0789c4a08e9a233cb6e54f160dc068b
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          ccoK.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ccoK.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 51e24787c9c460c58bf5f5c151d75541f614a262f44a563ce529acb3c6960d1a
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          ckIs.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ckIs.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                          • SHA256 e9d42faa25e87663a27db8b10d5f5223db4a66e91f73d6632a7e59c130958364
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          cwUm.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\cwUm.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.2MB
                                                                                                                                                                                                                                                                                                                          • SHA256 ea4190ce48574bb8c0811bf70ebf6997a6c33653504a4ecde38099c0d3ba4ec2
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          eEMq.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\eEMq.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 3edaf5483a3c91dbf53bf92b1634a5c5ea6d15840926ff374ca9fb8649c7d1b3
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          eOYM.ico
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\eOYM.ico
                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                          • SHA256 5963420fd9ba8c8248e3f50d179dfa21caca8538ad1482a03f260b27cf218043
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          eUcY.ico
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\eUcY.ico
                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                          • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          ekks.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ekks.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 a894dd7be9aca8f929318f61ae0493ebe1b95fe033e769a1284c5f3e3663dada
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          eoIS.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\eoIS.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.1MB
                                                                                                                                                                                                                                                                                                                          • SHA256 e073c7215d03d882593ec6e442131eb04f933adda57e0ae6de6e406d847c6220
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          eoMs.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\eoMs.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 37670d602d75530eed0b4c959c4b5d3ec357a6e0cd5617f5167c86bb0df291b0
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          eocG.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\eocG.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.2MB
                                                                                                                                                                                                                                                                                                                          • SHA256 50372ca73e3e5b16d44ab8f341a449e852f61bf73a59b715628fc25b4aeaf26a
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          file.vbs
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                                                                                                                                                                                                                                                          • Size 19B
                                                                                                                                                                                                                                                                                                                          • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          gEkw.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\gEkw.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 ea788a37b27050b2c44c4c3b706e5c01c8f69feab4ca61357c11c264a709ea3c
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          gQUMgMMs.bat
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\gQUMgMMs.bat
                                                                                                                                                                                                                                                                                                                          • Size 112B
                                                                                                                                                                                                                                                                                                                          • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          gUoG.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\gUoG.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                                                                          • SHA256 bae116be7c473055cce0e4470af6e38e4d757172a356d440f91d5b21ec010ed9
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          ggMG.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ggMG.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                          • SHA256 cac74d0e1e0686a6c838766c5182a696d10683e147279fcdb0b5d1758e34ef8f
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          goQQ.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\goQQ.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                          • SHA256 914e65a3edc744361dc137f49c14431f40da881efabd4f8381ff482d3bfb9c3f
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          gsou.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\gsou.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 894ae78e8d8f05333c49b5817f30b8dbe363d77d706acfbfeefe677a7a11c36f
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          gwQC.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\gwQC.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                          • SHA256 c325ba0eeaae67211af040e10550df7442d4bfc7b11ef312a2201f9473714954
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          iUYI.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\iUYI.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.3MB
                                                                                                                                                                                                                                                                                                                          • SHA256 3ae0f74944a8bbbee9b8a009134b5ae023e3c8ef297ba775f77fc0a1995e6b0a
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          iioU.ico
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\iioU.ico
                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                          • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          iwQw.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\iwQw.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.2MB
                                                                                                                                                                                                                                                                                                                          • SHA256 037efff39df10338eeb90044257459200c8b48372a2ed824ee05004f325371aa
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          kIIe.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\kIIe.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                          • SHA256 c87538f432cc0a06a8428aeacef669c0f5a5426cfde87a8228fb5cdf25436a53
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          kMQy.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\kMQy.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 ec484c0883d986b03a19e41e7a3e0c3aceb64107dae4142bef20093ceb61547d
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          ksok.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ksok.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 389f0c07436ca148782057d53e2abfcf785a48bb6276f2eada5db826d76798d9
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          kwkM.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\kwkM.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                          • SHA256 cc529349a7b8047732994c0a76c6f04506ff0758c89ad23778f24386d327b484
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          mEQO.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\mEQO.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.3MB
                                                                                                                                                                                                                                                                                                                          • SHA256 ef5fb24833fa3a42323308da7dffae2035ac0b7e56837ed9721674d07d01d3cf
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          mYAW.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\mYAW.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                          • SHA256 4be6e01c0a565951fc72fce94dc326d1b1bf1c0d73bc7c89bcce794cd2ae35a7
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          mgMe.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\mgMe.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 623504d25e7450a3075bd3ba19ada9c2b09abd1ebefdc62a7f02bd8cadaa4c7d
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          oAQA.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\oAQA.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                                                                          • SHA256 46da9e2151410db7c6db4e2a2b544702a7c587e0d734147bb728124862f19426
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          oEEg.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\oEEg.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 a96817b6fd14d035aaad5041f7275db3380c23b11ca4b2f1206a9e67ef2bb455
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          oUMA.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\oUMA.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                                                                          • SHA256 d2b3efd32b19915f4eec696248fba09022d20d792bd25b230f49a0a16ef0cdf4
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          oYkO.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\oYkO.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                          • SHA256 453a1a0957009ae0f62f56366ebaaa8f707ef3848725397bfa77b792a98830c2
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          ogQm.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ogQm.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                          • SHA256 c0dd5e1ad24401017bf7fcc8f06b0841b762871175bfccfc94798848f33b8fa4
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          ogYK.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ogYK.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 7e2c44282d17cd16ff8150e5796aaba045ad82324134ee88f75fae0339ad8e65
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          qAkO.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\qAkO.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                          • SHA256 d1b3991d5d99391013ce12c8f8b413c064714d288689f1ec03bb198edd6928d2
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          qEwO.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\qEwO.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.4MB
                                                                                                                                                                                                                                                                                                                          • SHA256 543e43b86d7aee8ea391efac28b6fda5aa50401db03b34b0c0044d4e91aa8ffe
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          qMkU.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\qMkU.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.4MB
                                                                                                                                                                                                                                                                                                                          • SHA256 ec791b37f66f2c5e21c8a3f3584579ac59db120f93235a0270a409108fd34703
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          qMoW.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\qMoW.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 beb1a1d127892b0600213ad75da06a6264a51e490497208c659605b9801e3966
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          qQAK.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\qQAK.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 2eecf0dbba508966b61fad0703d9986eb618ac4abe4ec1151a64175008a22381
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          qUwm.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\qUwm.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 17a87ff775dc7e72dc5c62857c142b320f8d4cbbc3f14daec8d9f93a97863c57
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          qsMQ.ico
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\qsMQ.ico
                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                          • SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          qwwA.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\qwwA.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 499c1da1b4c27ecba5404b98d12a0dc077bb1e8d5b7f1055f9e8e613d764a9c7
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          sAUS.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\sAUS.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 0733e9b5776c4e40465495942bc5130f4cf830fa21a7a1482ba62356047d5017
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          sQkW.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\sQkW.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 3b22d187076ae86d499b95e1eb6b33ded52de1cf25442ee75fe7602b623fb38a
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          sgkO.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\sgkO.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.3MB
                                                                                                                                                                                                                                                                                                                          • SHA256 27ed6953ccbdccad40dadcc0a8dbfd9132ae007801b49a69f1df321994a4a195
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          skgs.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\skgs.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                                                                          • SHA256 52f6ea8095293c99d6d1710ec09d08cd97a4aaee8d506a63791da907d7588031
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          soMk.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\soMk.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.5MB
                                                                                                                                                                                                                                                                                                                          • SHA256 c743621a720cc942a88d870c42100b5e74544540a80d09a5908b15b6aa241e3c
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          ukcu.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ukcu.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                          • SHA256 643650dff4e22d02919195158bf09eac3a3352753f2c019b8474b290e88daa45
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          usUu.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\usUu.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                          • SHA256 783bd37ced7f8a8471e6f33501199671e946029983dd8aad83416522526818f3
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          wQsc.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\wQsc.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 704765ba9a5781c4502002aca3f1e32e30bf8594db8cd5de16a6ebb80662b5bb
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          wYsC.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\wYsC.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.1MB
                                                                                                                                                                                                                                                                                                                          • SHA256 6366a2cf3393198964f2c47c2bbf953313eb509ef1c48031713edf861bb57218
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          wYwQ.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\wYwQ.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.2MB
                                                                                                                                                                                                                                                                                                                          • SHA256 8021ec3fa7ff489c5a29c0f5a8ad73385302c0304bc1f4c7344104f44dec1c5c
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          wosm.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\wosm.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 4e47d9086192b89d38a9169501cc44ecbe26662546d82b8150bd06311242aaa7
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          wsEY.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\wsEY.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.2MB
                                                                                                                                                                                                                                                                                                                          • SHA256 5be6c01616dc81b361a0dc94aee68b051cdc8db2f21ff82bffa274dd565903f6
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          wsMe.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\wsMe.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.8MB
                                                                                                                                                                                                                                                                                                                          • SHA256 66f203a3ba3ccbe9f5d7a792ce74111150ff465acb1e2d84ac19f5321f0dcd8d
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          yQMC.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\yQMC.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 4d9f83369210acfa2eb836505e2864fea6998761702eee9f98ba4010f2b697ab
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          yUkK.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\yUkK.exe
                                                                                                                                                                                                                                                                                                                          • Size 2.8MB
                                                                                                                                                                                                                                                                                                                          • SHA256 ba03db56673f446ec8f18586f2fde679adbba05a87c53ce15023bda9e1adabd1
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          yYAc.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\yYAc.exe
                                                                                                                                                                                                                                                                                                                          • Size 3.0MB
                                                                                                                                                                                                                                                                                                                          • SHA256 b27fcbd543b893430d84823362eaa425023b78a78a135d47e34f5a697484cba1
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          yYge.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\yYge.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                                                                          • SHA256 12c63a63e36d5f36e69554d0e9c7ceaa7515cc9c28b4624033879bea61d5a517
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          yaoQ.ico
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\yaoQ.ico
                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                          • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          yowQ.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\yowQ.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 ebdc19d73861a5268c880706545eb0aa7aa79f363663b06e27110769f6ea9e41
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          PEIIYQwU.exe
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\DacIcYMI\PEIIYQwU.exe
                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                          • SHA256 138bc6cac2928e0eef8f62473ae3ba22c42105c094f1d13cf25b99ccf610fad7
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          PEIIYQwU.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\DacIcYMI\PEIIYQwU.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 00c0454b520627311b190f76dc62433261b1572f50a14ffc9d85e7e71565372f
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          PEIIYQwU.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\DacIcYMI\PEIIYQwU.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 297cdabadaafb6a974bba7650ab61a51a0bac4dfb653fa251e737dfb8dbda650
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          PEIIYQwU.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\DacIcYMI\PEIIYQwU.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 defcbda882131ae14f36acb0983a7dc1e33da2b31f85fc29586c273af97e10e2
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          PEIIYQwU.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\DacIcYMI\PEIIYQwU.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 02634362210901a0df3794ba2c71eef39080c3a7995ca9796c61f42675b2a33c
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          PEIIYQwU.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\DacIcYMI\PEIIYQwU.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 af550294507e171d841ea786f1c4265e877aaca9eddca4b24c26d119f427c7ba
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          PEIIYQwU.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\DacIcYMI\PEIIYQwU.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 0a68777e4ef36a57fec20ece890579880b4495ed4b18a34f9d7598b09f93fe9e
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          PEIIYQwU.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\DacIcYMI\PEIIYQwU.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 61ce41f55d30bfbf58336ff68bc10a2c14767eb4aa6ee6d0576bfcb5b3a7c165
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          PEIIYQwU.inf
                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\DacIcYMI\PEIIYQwU.inf
                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                          • SHA256 9c395af9d8d41bb837e4f584084b23c30f4d2a2c5da1cf9e4557928b578a052d
                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                          memory/200-1939-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/376-2450-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/376-19-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/924-2047-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/948-1092-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/992-944-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/1100-2238-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/1144-2346-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/1204-7-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/1204-2438-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/1392-51-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/1592-2272-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/1592-2282-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/1716-2295-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/1812-2088-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/1900-2206-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/2072-2037-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/2180-2174-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/2248-75-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/2256-135-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/2320-163-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/2480-2359-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/2520-90-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/2744-2100-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/2760-116-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/2828-2248-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/2864-2473-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/2928-107-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/2940-2314-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/2984-1996-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/3168-2216-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/3176-2336-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/3220-2304-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/3252-257-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/3348-2024-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/3384-2152-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/3468-224-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/3860-2261-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/3864-237-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/3864-227-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/3884-2184-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/4128-281-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/4184-2229-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/4200-195-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/4264-2110-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/4420-2197-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/4448-14-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/4448-2444-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/4460-2120-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/4588-151-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/4612-2622-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/4680-2133-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/4720-2142-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/4812-2461-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/4880-1124-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/4888-2005-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/4924-2069-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/4932-2079-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/5200-1983-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/5204-63-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/5308-196-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/5308-209-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/5312-1973-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/5492-2060-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/5496-181-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/5588-2014-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/5664-1-0x0000000002340000-0x0000000002360000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/5664-30-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/5664-31-0x0000000002340000-0x0000000002360000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/5664-0-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/5672-2270-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/5672-2257-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/5760-2327-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                          memory/5772-2165-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                          Download