Overview

overview

10

Static

static

3

2026-08-01...ck.exe

windows10-2004-x64

10

2026-08-01...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 00:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
  • Size 1.6MB
  • Sample260802-akdepaam3x
  • SHA256 5f1f3a9e260979cf17b10f78dc76d7508db49c3758adbcfbff483aae1c877ac0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 35 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 35 IoCs
    defense_evasiontrojan
  • Renames multiple (117) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 35 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4592
    • C:\Users\Admin\vMQgEIcE\XAUgMIEQ.exe
      "C:\Users\Admin\vMQgEIcE\XAUgMIEQ.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of FindShellTrayWindow
      PID:3296
      • C:\ProgramData\waAMMMUk\GAUsYQEg.exe
        "C:\ProgramData\waAMMMUk\GAUsYQEg.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:4084
    • C:\ProgramData\waAMMMUk\GAUsYQEg.exe
      "C:\ProgramData\waAMMMUk\GAUsYQEg.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:4440
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4360
      • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4792
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2844
          • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2960
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4156
              • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1236
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1784
                  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4184
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:5464
                      • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                        11⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:704
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:1060
                          • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:3324
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:3592
                              • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                15⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:3768
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:912
                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:4304
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:3860
                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                        19⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1592
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                          20⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          PID:4248
                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                            21⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:940
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                              22⤵
                                              • Executes a command shell one-liner
                                              PID:1448
                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                                C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                23⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:4676
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                                  24⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:5368
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                    25⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:3852
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      PID:4552
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                        27⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:236
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3416
                                                          • C:\Windows\System32\Conhost.exe
                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            29⤵
                                                              PID:1216
                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                              29⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:2924
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                                                30⤵
                                                                • Executes a command shell one-liner
                                                                PID:5152
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                                  31⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:4696
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                                                    32⤵
                                                                    • Executes a command shell one-liner
                                                                    PID:4892
                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                                      33⤵
                                                                        PID:5808
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                                                          34⤵
                                                                          • Executes a command shell one-liner
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:5568
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                                            35⤵
                                                                              PID:4212
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                                                                36⤵
                                                                                • Executes a command shell one-liner
                                                                                PID:4088
                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                                                  37⤵
                                                                                    PID:4992
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                                                                      38⤵
                                                                                      • Executes a command shell one-liner
                                                                                      PID:2856
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                                                        39⤵
                                                                                          PID:624
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                                                                            40⤵
                                                                                            • Executes a command shell one-liner
                                                                                            PID:3784
                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                                                              41⤵
                                                                                                PID:5636
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                                                                                  42⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  PID:4400
                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                    43⤵
                                                                                                      PID:3760
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                                                                      43⤵
                                                                                                        PID:3696
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                                                                                          44⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          PID:3124
                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                            45⤵
                                                                                                              PID:5100
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                                                                              45⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:2384
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                                                                                                46⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:2584
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                                                                                  47⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:1136
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                                                                                                    48⤵
                                                                                                                    • Executes a command shell one-liner
                                                                                                                    PID:3732
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                                                                                      49⤵
                                                                                                                        PID:3172
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                                                                                                          50⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:1716
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                                                                                            51⤵
                                                                                                                              PID:2632
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                                                                                                                52⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:5928
                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                  53⤵
                                                                                                                                    PID:4624
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                                                                                                    53⤵
                                                                                                                                      PID:1000
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                                                                                                                        54⤵
                                                                                                                                          PID:5380
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                                                                                                            55⤵
                                                                                                                                              PID:996
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                                                                                                                                56⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:4968
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                                                                                                                  57⤵
                                                                                                                                                    PID:2572
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                                                                                                                                      58⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:4728
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                                                                                                                        59⤵
                                                                                                                                                          PID:5888
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                                                                                                                                            60⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:3868
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                                                                                                                              61⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:1536
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                                                                                                                                                62⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:3864
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                                                                                                                                  63⤵
                                                                                                                                                                    PID:3084
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                                                                                                                                                      64⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:4812
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                                                                                                                                        65⤵
                                                                                                                                                                          PID:3408
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                                                                                                                                                            66⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:1572
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                                                                                                                                              67⤵
                                                                                                                                                                                PID:4752
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                                                                                                                                                                  68⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  PID:2168
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                                                                                                                                                    69⤵
                                                                                                                                                                                      PID:1864
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock"
                                                                                                                                                                                        70⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:3092
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                        70⤵
                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                        PID:2320
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                        70⤵
                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                        PID:3736
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                        70⤵
                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                        PID:5640
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IkwAYQsk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                                                                                        70⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:3220
                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                          71⤵
                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:3832
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                    68⤵
                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                    PID:2808
                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                      69⤵
                                                                                                                                                                                        PID:5956
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                      68⤵
                                                                                                                                                                                        PID:268
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                        68⤵
                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                        PID:552
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XwgEwgoU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                                                                                        68⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:5856
                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                          69⤵
                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                          PID:2028
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                    66⤵
                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                    PID:5944
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                    66⤵
                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                    PID:1968
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                    66⤵
                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                    PID:1424
                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                      67⤵
                                                                                                                                                                                        PID:5764
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DEkkkgkc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                                                                                      66⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      PID:5684
                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                        67⤵
                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                        PID:5660
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                  64⤵
                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                  PID:5408
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                  64⤵
                                                                                                                                                                                    PID:1944
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                    64⤵
                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                    PID:6064
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FkYEgEUQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                                                                                    64⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:1180
                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                      65⤵
                                                                                                                                                                                        PID:388
                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                        65⤵
                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                        PID:4200
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                  62⤵
                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                  PID:3428
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                  62⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                  PID:6024
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                  62⤵
                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                  PID:1984
                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                    63⤵
                                                                                                                                                                                      PID:3168
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BscUUwkg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                                                                                    62⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    PID:2760
                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                      63⤵
                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                      PID:1252
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                60⤵
                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                PID:700
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                60⤵
                                                                                                                                                                                  PID:5744
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                  60⤵
                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                  PID:3752
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GyUYgcsM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                                                                                  60⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  PID:4428
                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                    61⤵
                                                                                                                                                                                      PID:1260
                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                      61⤵
                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                      PID:4312
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                58⤵
                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                PID:4760
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                58⤵
                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                PID:4220
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                58⤵
                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                PID:2824
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GwQsssAQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                                                                                58⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:5908
                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                  59⤵
                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:1948
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                            56⤵
                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                            PID:3168
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                            56⤵
                                                                                                                                                                              PID:3428
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                              56⤵
                                                                                                                                                                              • UAC bypass
                                                                                                                                                                              PID:2760
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HscgQcUg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                                                                              56⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:4868
                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                57⤵
                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                PID:5332
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                          54⤵
                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                          PID:1796
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                          54⤵
                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                          PID:4748
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                          54⤵
                                                                                                                                                                          • UAC bypass
                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                          PID:2456
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QQQIUoUs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                                                                          54⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:2828
                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                            55⤵
                                                                                                                                                                              PID:5768
                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                              55⤵
                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:5920
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                        52⤵
                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                        PID:2816
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                        52⤵
                                                                                                                                                                          PID:4220
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                          52⤵
                                                                                                                                                                          • UAC bypass
                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                          PID:1228
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GokIkkQk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                                                                          52⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:4484
                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                            53⤵
                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                            PID:4672
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                      50⤵
                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                      PID:2756
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                      50⤵
                                                                                                                                                                        PID:4812
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                        50⤵
                                                                                                                                                                        • UAC bypass
                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                        PID:5764
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hEoAUEIU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                                                                        50⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:1752
                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                          51⤵
                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                          PID:4920
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                    48⤵
                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                    PID:2928
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                    48⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:4756
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                    48⤵
                                                                                                                                                                    • UAC bypass
                                                                                                                                                                    PID:4772
                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                      49⤵
                                                                                                                                                                        PID:3100
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HeswMoYQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                                                                      48⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:2868
                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                        49⤵
                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:5956
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                  46⤵
                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                  PID:5772
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                  46⤵
                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                  PID:2028
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                  46⤵
                                                                                                                                                                  • UAC bypass
                                                                                                                                                                  PID:2784
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uUgIMMIQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                                                                  46⤵
                                                                                                                                                                    PID:5492
                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                      47⤵
                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                      PID:1928
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                44⤵
                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                • Modifies registry key
                                                                                                                                                                PID:1948
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                44⤵
                                                                                                                                                                • Modifies registry key
                                                                                                                                                                PID:3832
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                44⤵
                                                                                                                                                                • UAC bypass
                                                                                                                                                                • Modifies registry key
                                                                                                                                                                PID:4260
                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  45⤵
                                                                                                                                                                    PID:6104
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gSocQkcM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                                                                  44⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:4924
                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                    45⤵
                                                                                                                                                                      PID:6136
                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                      45⤵
                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                      PID:5072
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                42⤵
                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                • Modifies registry key
                                                                                                                                                                PID:1076
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                42⤵
                                                                                                                                                                  PID:5652
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                  42⤵
                                                                                                                                                                  • UAC bypass
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:2860
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wuMgoAgk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                                                                  42⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:1216
                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                    43⤵
                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                    PID:3220
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                              40⤵
                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                              PID:4832
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                              40⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              • Modifies registry key
                                                                                                                                                              PID:3716
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                              40⤵
                                                                                                                                                              • UAC bypass
                                                                                                                                                              • Modifies registry key
                                                                                                                                                              PID:3752
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dYgUgUsY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                                                              40⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:2900
                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                41⤵
                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                PID:388
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                          38⤵
                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                          • Modifies registry key
                                                                                                                                                          PID:5304
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                          38⤵
                                                                                                                                                          • Modifies registry key
                                                                                                                                                          PID:1716
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                          38⤵
                                                                                                                                                          • UAC bypass
                                                                                                                                                          • Modifies registry key
                                                                                                                                                          PID:1988
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WKYkMkwc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                                                          38⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:5632
                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                            39⤵
                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:716
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                      36⤵
                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                      PID:3100
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                      36⤵
                                                                                                                                                      • Modifies registry key
                                                                                                                                                      PID:1056
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                      36⤵
                                                                                                                                                      • UAC bypass
                                                                                                                                                      • Modifies registry key
                                                                                                                                                      PID:5888
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MkwgIcMo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                                                      36⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:4444
                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                        37⤵
                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:5968
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                  34⤵
                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                  • Modifies registry key
                                                                                                                                                  PID:1260
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                  34⤵
                                                                                                                                                  • Modifies registry key
                                                                                                                                                  PID:3236
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                  34⤵
                                                                                                                                                  • UAC bypass
                                                                                                                                                  • Modifies registry key
                                                                                                                                                  PID:3192
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UGcccQgE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                                                  34⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:1452
                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                    35⤵
                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:1928
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                              32⤵
                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:6136
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                              32⤵
                                                                                                                                              • Modifies registry key
                                                                                                                                              PID:3084
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                              32⤵
                                                                                                                                              • UAC bypass
                                                                                                                                              • Modifies registry key
                                                                                                                                              PID:5768
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZwsssYYE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                                              32⤵
                                                                                                                                                PID:4816
                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                  33⤵
                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                  PID:5772
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                            30⤵
                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                            PID:3980
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                            30⤵
                                                                                                                                            • Modifies registry key
                                                                                                                                            PID:4776
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                            30⤵
                                                                                                                                            • UAC bypass
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            • Modifies registry key
                                                                                                                                            PID:3900
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pussYAcc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                                            30⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            PID:3200
                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                              31⤵
                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                              PID:3316
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                        28⤵
                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        • Modifies registry key
                                                                                                                                        PID:4624
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                        28⤵
                                                                                                                                        • Modifies registry key
                                                                                                                                        PID:2348
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                        28⤵
                                                                                                                                        • UAC bypass
                                                                                                                                        • Modifies registry key
                                                                                                                                        PID:5344
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EEYQQwQM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                                        28⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:256
                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                          29⤵
                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                          PID:3760
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                    26⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:4136
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                    26⤵
                                                                                                                                    • Modifies registry key
                                                                                                                                    PID:3172
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                    26⤵
                                                                                                                                    • UAC bypass
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    • Modifies registry key
                                                                                                                                    PID:552
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EGwYsYMM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                                    26⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:3336
                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                      27⤵
                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                      PID:240
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                24⤵
                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                PID:1940
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                24⤵
                                                                                                                                  PID:3612
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                  24⤵
                                                                                                                                  • UAC bypass
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  • Modifies registry key
                                                                                                                                  PID:5340
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KusUYwIw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                                  24⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:2308
                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                    25⤵
                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                    PID:4668
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                              22⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:3180
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                              22⤵
                                                                                                                              • Modifies registry key
                                                                                                                              PID:3224
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                              22⤵
                                                                                                                              • UAC bypass
                                                                                                                              • Modifies registry key
                                                                                                                              PID:4580
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\haIQYwoI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                              22⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:1096
                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                23⤵
                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                PID:1056
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                          20⤵
                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:5100
                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                            21⤵
                                                                                                                              PID:4560
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                            20⤵
                                                                                                                            • Modifies registry key
                                                                                                                            PID:3084
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                            20⤵
                                                                                                                            • UAC bypass
                                                                                                                            PID:6104
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RAookoQQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                            20⤵
                                                                                                                            • Executes a command shell one-liner
                                                                                                                            PID:2476
                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                              21⤵
                                                                                                                                PID:548
                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                21⤵
                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                PID:5916
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                          18⤵
                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:3888
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                          18⤵
                                                                                                                          • Modifies registry key
                                                                                                                          PID:3124
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                          18⤵
                                                                                                                          • UAC bypass
                                                                                                                          PID:2660
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\naoYIIQo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                          18⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:580
                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                            19⤵
                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                            PID:4084
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                      16⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      PID:3332
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                      16⤵
                                                                                                                        PID:4188
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                        16⤵
                                                                                                                        • UAC bypass
                                                                                                                        PID:4332
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cKQcgkow.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                        16⤵
                                                                                                                        • Executes a command shell one-liner
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:1276
                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                          17⤵
                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:4544
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                    14⤵
                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Modifies registry key
                                                                                                                    PID:1772
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                    14⤵
                                                                                                                      PID:1984
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                      14⤵
                                                                                                                      • UAC bypass
                                                                                                                      PID:4292
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oSsIMIok.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                      14⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:5952
                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                        15⤵
                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                        PID:5968
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                  12⤵
                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                  PID:3736
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                  12⤵
                                                                                                                  • Modifies registry key
                                                                                                                  PID:1944
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                  12⤵
                                                                                                                  • UAC bypass
                                                                                                                  PID:5672
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HsEQsgEQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                  12⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4844
                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                    13⤵
                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                    PID:4532
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                              10⤵
                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Modifies registry key
                                                                                                              PID:1476
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                              10⤵
                                                                                                                PID:3732
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                10⤵
                                                                                                                • UAC bypass
                                                                                                                • Modifies registry key
                                                                                                                PID:1536
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZOsQosck.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                                10⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5964
                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                  11⤵
                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:3116
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                            8⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            PID:3316
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                            8⤵
                                                                                                              PID:5764
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                              8⤵
                                                                                                              • UAC bypass
                                                                                                              • Modifies registry key
                                                                                                              PID:548
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tSgkUAoY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                              8⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1852
                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                9⤵
                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                PID:1448
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                          6⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          • Modifies registry key
                                                                                                          PID:2712
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                          6⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Modifies registry key
                                                                                                          PID:2964
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                          6⤵
                                                                                                          • UAC bypass
                                                                                                          PID:4728
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UaogosoE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                          6⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5376
                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                            7⤵
                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                            PID:4560
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                      4⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Modifies registry key
                                                                                                      PID:1216
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                      4⤵
                                                                                                      • Modifies registry key
                                                                                                      PID:5736
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                      4⤵
                                                                                                      • UAC bypass
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Modifies registry key
                                                                                                      PID:5720
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KookQIUw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                      4⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1500
                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                        5⤵
                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                        PID:4400
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                  2⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Modifies registry key
                                                                                                  PID:6004
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                  2⤵
                                                                                                  • Modifies registry key
                                                                                                  PID:268
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                  2⤵
                                                                                                  • UAC bypass
                                                                                                  PID:240
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xmkQMsgw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock.exe""
                                                                                                  2⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:3352
                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                    3⤵
                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                    PID:1404
                                                                                              • C:\ProgramData\YYkkssgg\DQIccgks.exe
                                                                                                C:\ProgramData\YYkkssgg\DQIccgks.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Adds Run key to start application
                                                                                                • Drops file in System32 directory
                                                                                                PID:1192
                                                                                              • C:\ProgramData\waAMMMUk\GAUsYQEg.exe
                                                                                                C:\ProgramData\waAMMMUk\GAUsYQEg.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Adds Run key to start application
                                                                                                PID:3956
                                                                                              • C:\Users\Admin\vMQgEIcE\XAUgMIEQ.exe
                                                                                                C:\Users\Admin\vMQgEIcE\XAUgMIEQ.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Adds Run key to start application
                                                                                                PID:4144

                                                                                              Network

                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                    Reconnaissance

                                                                                                    Resource Development

                                                                                                    Initial Access

                                                                                                    Execution

                                                                                                    Command and Scripting Interpreter

                                                                                                    2
                                                                                                    T1059

                                                                                                    Visual Basic

                                                                                                    1
                                                                                                    T1059.005

                                                                                                    Windows Command Shell

                                                                                                    1
                                                                                                    T1059.003

                                                                                                    Persistence

                                                                                                    Boot or Logon Autostart Execution

                                                                                                    1
                                                                                                    T1547

                                                                                                    Registry Run Keys / Startup Folder

                                                                                                    1
                                                                                                    T1547.001

                                                                                                    Privilege Escalation

                                                                                                    Abuse Elevation Control Mechanism

                                                                                                    1
                                                                                                    T1548

                                                                                                    Bypass User Account Control

                                                                                                    1
                                                                                                    T1548.002

                                                                                                    Boot or Logon Autostart Execution

                                                                                                    1
                                                                                                    T1547

                                                                                                    Registry Run Keys / Startup Folder

                                                                                                    1
                                                                                                    T1547.001

                                                                                                    Defense Evasion

                                                                                                    Abuse Elevation Control Mechanism

                                                                                                    1
                                                                                                    T1548

                                                                                                    Bypass User Account Control

                                                                                                    1
                                                                                                    T1548.002

                                                                                                    Hide Artifacts

                                                                                                    1
                                                                                                    T1564

                                                                                                    Hidden Files and Directories

                                                                                                    1
                                                                                                    T1564.001

                                                                                                    Impair Defenses

                                                                                                    1
                                                                                                    T1562

                                                                                                    Disable or Modify Tools

                                                                                                    1
                                                                                                    T1562.001

                                                                                                    Modify Registry

                                                                                                    4
                                                                                                    T1112

                                                                                                    Credential Access

                                                                                                    Credentials from Password Stores

                                                                                                    1
                                                                                                    T1555

                                                                                                    Credentials from Web Browsers

                                                                                                    1
                                                                                                    T1555.003

                                                                                                    Unsecured Credentials

                                                                                                    1
                                                                                                    T1552

                                                                                                    Credentials In Files

                                                                                                    1
                                                                                                    T1552.001

                                                                                                    Discovery

                                                                                                    System Information Discovery

                                                                                                    1
                                                                                                    T1082

                                                                                                    System Location Discovery

                                                                                                    1
                                                                                                    T1614

                                                                                                    System Language Discovery

                                                                                                    1
                                                                                                    T1614.001

                                                                                                    Lateral Movement

                                                                                                    Collection

                                                                                                    Data from Local System

                                                                                                    1
                                                                                                    T1005

                                                                                                    Command and Control

                                                                                                    Exfiltration

                                                                                                    Impact

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    HOow.txt
                                                                                                    • Path C:\ProgramData\HOow.txt
                                                                                                    • Size 8KB
                                                                                                    • SHA256 c56d839221d79822462865490e9d186577c218389049400db8fee8de12256848
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    DQIccgks.exe
                                                                                                    • Path C:\ProgramData\YYkkssgg\DQIccgks.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 f639faadc21e52da149a090c1c8c3b7fd0fb7c207f2d6a915bdf40c45d4fb019
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.exe
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 a24a730d94dcd09320c0f88a236049d0d0edd74b2927448d35facc8ddcab5b5f
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 83c89287c9eb4106dbdc3e1e71a5a898387208fbecac1fad88fe6754f2197bb5
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 cabec110bd7d4e8237ebf94e068147e806e9d51a28d757548123142ea48efd57
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 cf54f7c0bab010522532c1363c7cc52df3a92c9ade326a1509e047cf838a31f8
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 c2711523542415777b1c6d769b1023e2b7fb9016432d66696aafcf8dfa3b2ea5
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 fabaedc2100b3322927ed3ceeef2190f99ed7bbc271b84875710c81c0729baef
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 0fa7d0d10ac38e95cb647ed8b69a742988f0492f45dd2b0a152b6306c014f186
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 2bd91700e15c9c27a03245c72612df67486529b434c22dd7b871bc7adf224d0f
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 421bd03b76a36f6d8415fe1d85ba5d372a893ec8f26cc24eda60be6beed56e5d
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 4ed2d1ab355568aa073fd06662f6d98a820b9b556a8810cdfefbcc25401d2e39
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 46bf75bba9169d0131f552712e62f41ce784d185989727a5e79616e664f46609
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 f0d22e8ba53c516556fa49398a2c4f6176f3ad8abf877c00e0d9a28fc419bc10
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 d4636aa9791ae7aa10d56310356ea40cb6ebbd504e091829c44afbcdd4656a8c
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 d7991ce0312fb5543dd3f315215ad398dba87654ce64b4e5d9b29c7d0387acc6
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 c0788246a84f82fe65659d85b5ccb0f7f52b588b7768bc953b46e0e296fd8d3e
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 9892d8fb9820750c652a3cbf334591f8f035e54b845083f1fa226cc0d6eb3bf2
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 baf3ea5df4458a67a3f5d0d307336e8297f4a3da6b2502d9af107c98ee1800a1
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 98fd146d2f648bf9e6791b0e1fd33820a07d18eb13ec65765d823a5e809435b6
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 883cb4afb0597b1518b97bfc4e5bdf8ab63b79a312b969c3aaa3b051cb55b329
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 fe2bb9012e7165c27fcbef93a055d6f5ee56e288955f7ae9d7c37cf5a90f5e90
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 e8bde1978c0faeb8afef9d9fe7ead004ea91c31e80afaf91d08067f58e492c05
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 eba36984bbd592bc192a2b0f12fe8d16510f5e8c10c50c1786c536580f65e452
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 fc8b77d967c35d4617bb1650848b2df0e2552a081c6190e6d8b507ef4d18091f
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 0e3723fbbd15968b5f8f35398f4479a5a868322ab68d52517f4f6bc4afdf3618
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 1afd42943e8027dbff3df4262c29fa4079b10ade3c7ecdac34d0f40255786621
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 d0d8322e86b5c1fb50265a45dd67528e54dcd6135d5de2efc343c6a2b267aba5
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 f4fa45e81cf2440d3b5c4cd11bb0fe2079e408e9b56a87a005a676e105b44ed4
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 097c9babc9894fd434506176b929f87e9b10c66ce8d01109b2996d66a614e8c0
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 62eca501d3fc4487f743f789711c2b84853f3334b1fdd21255b8fa16b6d47a80
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 4c95cdc5ea114d0308f7cfa2f888027585cef036e9465bf45e2942cf74b6fcba
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 08c225048af88c55d205136fded2b6d0820fe5f7f8b8aed2f4dab5e577133d83
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 6e3b17b9ee6c5e8cd4d8d3838a62373f0b62ddc51076f3ecabf6f9c57c0af3a0
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 c645a22d6f89edc24ec24c69d921268edbafdc4b381050df10713beef68c8836
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 f587e11f70bbce6bd4c7ebfea3113c0f2558fc83c68f859b2f1ed6de618fdc57
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 08ff178ada0a447248f0d7ed7e1d2cd058cdfba70c721630d327222cf38a50c1
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 413e6076770dfefb3614e7d62b685468ea39d9551d5e7d2963342255af5c0131
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 781c3c170a110a6816b583bfa12bc2eb6d4d8b9de530f854deda17356b2360a1
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 f15a092eee98bc4bc11eb7ac763de0999566fe1f183ce364b202d5a7265a94cf
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 320c49ca58de85cc09b30cbb43f3129c0992dcd373a26f618750ee4e0c091899
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 b33ea17c32bffc36e6be9f1d8cef89a1ad3c414efbab346a261c52e3e57c3475
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 81456d22b19afbebf6f17345b4a241341dc5e6a1f9fdc30cf01a91d0151c589c
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 670a1854d492b8dcc7a1ea6bcd20a16cbd2bf4aee550255694e42eb9406249ed
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 3bc4015ce60c864d857785e0e69aa193ea2f536ddd014895eb660a983d2c470c
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 96118a0619b59c7f3b091b92820be33136c5f1988e306615b221974baf0cad5e
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 f804d65d0227300919237b50806d0de2c98c15cef46d11f812036ffbc2a0a1d0
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 3789235d06aec7ecc2517133f7f75e34aa8e12c76313ac3d36122d4e7482a970
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 5cec7683d573b8e89c0a4b22113722bfced3d693b1a438c87c1042b7cfc08e03
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 5b5559fd84f71b404bfcd5441d8a0f6c13f677016a262600eb7fe71157941d18
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 cd48993bc4cc68d8faf772f4831a5f464208558249e22c4921dc4263f6b50171
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 0a45da9894445a9ee28bf1cd52ad41184224d70dcc0e6a3f2778c4726c9beb3e
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 2d571a75fc3dff2d13cc43565ad3bfefa9f77371f0a2467f0d48ce1c0860842b
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 d27d20a6ca1f1cbdaf2596bedf7ae947293856843b005f9b5f6d5d013b7e6759
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 897dcdbf7e6673e3b1753d1488ec82ae62b17db0db5e5320264a5b7fd0302856
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 9ca5b609204c413ea0dce9ede6c4f3b1b2aeaa4b9404bbb85c3c6385d6ce23f8
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 8b2597b102fa2728bfaf993ae94127ef02a4b4149155b252548f31b3eb64e4a7
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 b0ee8ad69f40b32c567ef68d6a1dfa48eb6191b7596da16f8ead2a9743a6c701
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 648c3fbddabf9b7d02cd4e70f1713de3c6b25420e62f7f923fe27d2a3693295f
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 72765824b41cc06e25ce3969e6e224c1a9f37f594f6062d5000e7e55d9e6b86a
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 c388cfaccbe9f1a658580c435ac8503fd51a5bbc645d3417710222748483fa3c
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 47c57b599485d7dadf3a51a05e652c67b605daf816871c74d7440e702d55201e
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 6992ee3f71c376504e19042e92eb27d7cd7c351eb63375abd601658d93bccfc4
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 4d74b2eeaf34141359053986df6a55871e1dda62bced243b8b2e331d56881e3c
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 0c10cae2dda294930c71be1b96ebaac8dab2d20e8476dd73893f120e021c58e0
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 a905ed87f4cdf10cc3008664ad90bc95fad3cce8dfbcbc82ff957b9e66763674
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 45f431968b5d91b5210111daf7b019f8ea3424dd501fdf24a97b78b1dc3a5249
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 c088ecc9e318cd02c9a6cf1b831214c958331752d355e37f7dcbf8ed1096e06b
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 c4dfef2f344c64c929d0db2cb1859b02adb878248395272706148481bb0e2284
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 74c13344cca141b48f209281acfa811818994bc6e95c56d20967d7a0adb43b6f
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 7e6c2924fdefb96aa9300c6cfc68d6ca693d6003488efe659649fd3de221248d
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 1e463d23fbb8bc06a1faca0f6dffcf4b3f05ade28d4549cf6a2108b65d058952
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 1eee3a2e6e6c0a09433ddac7855d48084f40ffad445293458e0056740d50a6c8
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 5106232d33b7b93c29fa66ea3b4f0c8b0175b3a199dff33e00d497ca19bacaa4
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 e9b45d5d4e53b9a2ed01045c365fb48562e170d8000789b53c83e4929ef9732e
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 bf2a72cd76b8c043f6740fcfff03822a3d39dd4c5dcfc0a46ed633734ee9937f
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 326e35b5f474d3d6f3a6c4598bd82f5bdfecfe289266b2295d6c3650977648cb
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 1368565cbc16db783cd0f7bac27130d4f885b99f7682b93e7eb30a376b970141
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 b9cd45d5b5bfae4cda0cdee8f780cd348dc6f96997938d22b74d5798053fa44c
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 db347c036cb23ac322b4942b459060fae6f4ebd35761b35a093b7b402cbdd5a8
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 e6d959d2803c1228df4616ea770623210c78e962f8e56863889a380e4beab837
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 f7e47948305dd6385c07d1bcc4a03eae1ec5bf7b039fa40082b1ae8d69f53b43
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 a22013eb01a4ac0061739f549b40a1ade166f5110d60d7ff1bb78c63dd06700f
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 20e5712cb9f0dd43fa93ceaa58433c2a7a1e6b78f788002a6579c0c127505edc
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 095fa4bd13ac3b9f4513d4151503d702cd876253a7048076d97f7e7a536347c8
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    GAUsYQEg.inf
                                                                                                    • Path C:\ProgramData\waAMMMUk\GAUsYQEg.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 324f05bf3ac6cad4d5cfd9f4e9f4e4f679798c598bd3a095adfee0c95aaeb2a1
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-08-01_8e58a9e72c057fd15939cdd2b884be7a_elex_virlock
                                                                                                    • Size 7KB
                                                                                                    • SHA256 14d3bd5262c935774bc0bcdd5fc14c6b212b7ae1e80af779891fe3a547ed1ab9
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    AAgM.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\AAgM.exe
                                                                                                    • Size 2.2MB
                                                                                                    • SHA256 d07fdd5b506f47bf7bb52eafb52c9d038e61534723d1e0f3cff8efed81918fbe
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    AEQg.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\AEQg.exe
                                                                                                    • Size 2.7MB
                                                                                                    • SHA256 7567d8e8ed0f2e7fa139846e8b89f4637b45ef95b5cd6318d519a5b6de1fa9a8
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    AMAC.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\AMAC.exe
                                                                                                    • Size 2.5MB
                                                                                                    • SHA256 703e5efe3ecf6ad47e60746f11d260893dfeba4bc76f1e71e1b0522aee2284dc
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    AMAm.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\AMAm.exe
                                                                                                    • Size 1.8MB
                                                                                                    • SHA256 120aa87c6175c490a119f6f0a4b9f3ba72b1c68a4f87940018165794f4c3078d
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    AUES.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\AUES.exe
                                                                                                    • Size 1.9MB
                                                                                                    • SHA256 68c1598435b77df2247689b03835f1dac309c53d44cb5ea2267cf8deb11a1e33
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    AcUE.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\AcUE.exe
                                                                                                    • Size 1.9MB
                                                                                                    • SHA256 2914d209aad76fd90cb25cb76410c2b8c366a57d8fc1a1ac109cb55326f85c6b
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    AooA.ico
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\AooA.ico
                                                                                                    • Size 4KB
                                                                                                    • SHA256 5963420fd9ba8c8248e3f50d179dfa21caca8538ad1482a03f260b27cf218043
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    CYAO.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\CYAO.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 7f8d033691e233eb5877d630284665a1ca9b927924972fb9bd40c31f5e6efcb0
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    CYMc.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\CYMc.exe
                                                                                                    • Size 2.5MB
                                                                                                    • SHA256 5d8a30ed79fb639a91b68034d2c0d07ccff7a787107ce072da135763c7c9b535
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    EEAk.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\EEAk.exe
                                                                                                    • Size 1.9MB
                                                                                                    • SHA256 5d0308aa2d86c913b15598a9f633ecd1eca90cd38455f9168b1b5e6127c226ab
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    EIkc.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\EIkc.exe
                                                                                                    • Size 1.7MB
                                                                                                    • SHA256 54a24ac4090efe60c1cfc50ad7a657092ec0cc053bf9bdb8d3452487a1bfa02b
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    EMAC.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\EMAC.exe
                                                                                                    • Size 2.0MB
                                                                                                    • SHA256 c891082177f87525c73c55f4f50da84e16c9268ef733be3da7bd3ebc4f67308a
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    EQMI.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\EQMI.exe
                                                                                                    • Size 3.1MB
                                                                                                    • SHA256 d6db994de8440ca76e5ba2d0e05b6ed693d583d6bad9c62194168b94df4fd62e
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    EsUw.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\EsUw.exe
                                                                                                    • Size 2.3MB
                                                                                                    • SHA256 25944ec5b5046b7f9be869e79aee1ef114dfdee7b90dfc199306c256d87eef2c
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Eskm.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Eskm.exe
                                                                                                    • Size 2.0MB
                                                                                                    • SHA256 eefa09fe919240bf80aa56e3475aa823c8e6dfad8841bd6db53c6717ae694982
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    GIcC.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\GIcC.exe
                                                                                                    • Size 2.0MB
                                                                                                    • SHA256 1694c8e4ba0dc0b530a764f3f14cfebd24974f037bf40183c7f59f109eb8060c
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    GIgc.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\GIgc.exe
                                                                                                    • Size 2.1MB
                                                                                                    • SHA256 2579d65f6235f57b57f32e3dee82ae4684c9f31b2861b9408c58f3a9542db590
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    GMgC.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\GMgC.exe
                                                                                                    • Size 1.7MB
                                                                                                    • SHA256 97be22df952c409276e12ff95bf1b1f290faa2f1f666c93b6e83e2b1f6196af9
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    GQkU.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\GQkU.exe
                                                                                                    • Size 1.8MB
                                                                                                    • SHA256 e7dad0e3caf63e773ad6c85350bf3d2075ecf946f7c04df03ed65d8c05676e29
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    GQsY.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\GQsY.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 c281757c54e47d6fed8a384d8513b46a0d91625c33884587f5498b13b453f97d
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Ggsk.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Ggsk.exe
                                                                                                    • Size 1.9MB
                                                                                                    • SHA256 16bc53ce0bb71609e965098e12a5672de9095f9812f7267bc0783e5976fac437
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    GuQk.ico
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\GuQk.ico
                                                                                                    • Size 4KB
                                                                                                    • SHA256 9a233711400b52fc399d16bb7e3937772c44d7841a24a685467e19dfa57769d5
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    IIIA.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\IIIA.exe
                                                                                                    • Size 2.2MB
                                                                                                    • SHA256 1a66ebcbfe5f2ae67d96fe850c59178b9ba8fd0c2ceeb8176f259c5bc171ac07
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    IgQA.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\IgQA.exe
                                                                                                    • Size 2.1MB
                                                                                                    • SHA256 4f28cfd962f84e068d0e56adf6d8491852e0799b26dc43f78a5c29aafb8d6c88
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    IsEm.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\IsEm.exe
                                                                                                    • Size 2.0MB
                                                                                                    • SHA256 a1ba3f0efebaa86ca87e82a3e641abd8b1ea647fca267f7499299f86d662f4d6
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    KQMW.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\KQMW.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 ea9c516b4e5df88b93ece690c1799d507905c7dca66f2ef27375a74bb87336b1
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    KoQQ.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\KoQQ.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 8cc21d163a4506ba4f7a2c33575e17d315c0826fcabc4d573e0426ad5d5afdb5
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    KookQIUw.bat
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\KookQIUw.bat
                                                                                                    • Size 112B
                                                                                                    • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    KwgS.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\KwgS.exe
                                                                                                    • Size 1.9MB
                                                                                                    • SHA256 3861a0941c13ad79d4ecad80bbdf265f606f6e8ee783477007019c3c4714e68f
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    MAog.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\MAog.exe
                                                                                                    • Size 2.1MB
                                                                                                    • SHA256 80e7d357acd54c881ce90ea0d0501fb24ba4772fceea7b3dd50187fd78727ad3
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    MIwE.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\MIwE.exe
                                                                                                    • Size 2.2MB
                                                                                                    • SHA256 576ec91e9e986314b1b3e61eed55d567b4dedbd22d086657965fa21000f8ed03
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    MSoA.ico
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\MSoA.ico
                                                                                                    • Size 4KB
                                                                                                    • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    MYMG.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\MYMG.exe
                                                                                                    • Size 1.7MB
                                                                                                    • SHA256 553b1bf689d632037baa4c6b600361a44518815b18c419c044de36f82178ad6c
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    MYoC.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\MYoC.exe
                                                                                                    • Size 2.3MB
                                                                                                    • SHA256 527c14af50292bcb196456ec80ad50bad906c21104ffdba454dbe4e4d7f95be6
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Meoo.ico
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Meoo.ico
                                                                                                    • Size 4KB
                                                                                                    • SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    MgcC.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\MgcC.exe
                                                                                                    • Size 1.8MB
                                                                                                    • SHA256 c14ca6e4b0a83e3041f046695a7ad6326a961d95b0e6959efbde3c7554551063
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    MoMq.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\MoMq.exe
                                                                                                    • Size 1.7MB
                                                                                                    • SHA256 079e38c25677d4a94f160393877c254de9c5d2538aaa78c84bc853e73db5aef2
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    OIcI.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\OIcI.exe
                                                                                                    • Size 2.2MB
                                                                                                    • SHA256 ca0db3bb20b66fce6ddb44465363f1edf88b4dd02d57513c8520ab13feadf8b3
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    OMsA.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\OMsA.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 840c8f55049fb4e5b849c979455eab773f45199de7cd5b9ec22eaf47e16b3753
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    OYAI.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\OYAI.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 d12a7ebed9da79c893e45f53a6a2d3d3280fc0a20b1e5352c626ba1fd9fe06c7
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    OqgM.ico
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\OqgM.ico
                                                                                                    • Size 4KB
                                                                                                    • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    QQsa.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\QQsa.exe
                                                                                                    • Size 2.1MB
                                                                                                    • SHA256 8ca11d3a6a52aca1142097ebfd1f05e59a2a4b58094851b2585c8e406dc932ce
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    QYwC.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\QYwC.exe
                                                                                                    • Size 1.9MB
                                                                                                    • SHA256 f076b70fd9e55659adf2c7f76cf614be741e2677d5788262a14fed3f9a27646a
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    QcQi.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\QcQi.exe
                                                                                                    • Size 2.6MB
                                                                                                    • SHA256 92efce90d51f63ee9585a23a20fd9cdb6a84d5e0326cfb5de51acc14cf234085
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Qcwg.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Qcwg.exe
                                                                                                    • Size 2.0MB
                                                                                                    • SHA256 a3d729bc9e44bba561601ac0073857780c02883bd9c8dc101ff817580e0e82b9
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    SEkk.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\SEkk.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 cb45112598fdc0a28af0e44dd23c99d09ba16eb3ad5e50bdc07fa488baf92623
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    SOkI.ico
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\SOkI.ico
                                                                                                    • Size 4KB
                                                                                                    • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    SsAo.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\SsAo.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 8ca0e5add2a2177d1c066100100ae0b0191d9e4309e3672e642d15917b90f81f
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    UEYW.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\UEYW.exe
                                                                                                    • Size 2.2MB
                                                                                                    • SHA256 69ce08d2fe3722959510e231bb63829d765d08b51d3ee17196d3d2f3508e8d11
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    UEwa.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\UEwa.exe
                                                                                                    • Size 1.9MB
                                                                                                    • SHA256 cb8086e9a9d4e433665daf14f4d7dc3104ed78513eb737ffd107e5085467b0b0
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    UMYA.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\UMYA.exe
                                                                                                    • Size 1.8MB
                                                                                                    • SHA256 c2603618b11678dddf4248d91a6be178685ec4cad8278ceee595a958e0dc2fac
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    UQYY.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\UQYY.exe
                                                                                                    • Size 2.8MB
                                                                                                    • SHA256 2e7523379949a87a3c245940067bad6873e6d106190cf6453c5d5751142e43cf
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Ukww.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Ukww.exe
                                                                                                    • Size 2.0MB
                                                                                                    • SHA256 441ef88c015845d87c11312f4a8f24e3f76be9c81d395f8a28e4afe247f8ba3a
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    UoUO.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\UoUO.exe
                                                                                                    • Size 1.8MB
                                                                                                    • SHA256 dfb02c14b99cb364c5e1b801f302168efb03b544769998b5b3bfc4bb3194512a
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    UwAg.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\UwAg.exe
                                                                                                    • Size 1.9MB
                                                                                                    • SHA256 7e1672b47ac1dc7c9022ea1b6bc5237ad8783b5591ba4b9bc4c6c9cd4871a46c
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Uwkc.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Uwkc.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 a06b6caef78e6bdaf5f2849c42827aa8f55948b409bbe07807e5c586b9c75d47
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    WEoG.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\WEoG.exe
                                                                                                    • Size 1.9MB
                                                                                                    • SHA256 68f82413a266cbd7f03e1b27ee09c4382082b9035a7fd075595e62bf3db36022
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    WIoW.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\WIoW.exe
                                                                                                    • Size 2.2MB
                                                                                                    • SHA256 9f16d1be0234a17e35708ec3882d0c51c070b34866a0214dd8a6936f721fcf89
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    WSIo.ico
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\WSIo.ico
                                                                                                    • Size 4KB
                                                                                                    • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    WUEs.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\WUEs.exe
                                                                                                    • Size 1.9MB
                                                                                                    • SHA256 bacee7996a2a652bafacca651b81ed8f061edca101f902619d76c6294eee682f
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    WUUA.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\WUUA.exe
                                                                                                    • Size 1.7MB
                                                                                                    • SHA256 a7b690340b5638d586f73c2b2e718934f99c5396a3f9449ea3e52e3fb008df0e
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    WUgK.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\WUgK.exe
                                                                                                    • Size 2.1MB
                                                                                                    • SHA256 3d1158738c38d478948fb141259c8b8db8e29a3e386b59b7ff6d9de76cfc019a
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    WYIC.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\WYIC.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 4c6120901e3763553a83b3e5d35cf8ddad1f2fbbcbdce2f7e6c58a41e307fcb6
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    WYga.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\WYga.exe
                                                                                                    • Size 2.2MB
                                                                                                    • SHA256 5688a129e04b5fe5941242168e55db2801ca022ef8099ed3af09894263400338
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    WYgo.ico
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\WYgo.ico
                                                                                                    • Size 4KB
                                                                                                    • SHA256 114dae4c54ca426f78e50998727dac92942261d71ca5b2dbaf413794dcf8ad82
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    WckK.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\WckK.exe
                                                                                                    • Size 1.9MB
                                                                                                    • SHA256 502a1104cf7ceebe81170744172777162a9d7c5e295d4c842c40c535c84576f1
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Wgsu.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Wgsu.exe
                                                                                                    • Size 2.0MB
                                                                                                    • SHA256 c037cd28510310ede840debd8a9a8c692bc613e799c5e785865e0a5904a22c8e
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Wwws.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Wwws.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 255db21483dd040b164d2873823de58f11e2b10372df5782199c643ce32898fa
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    YIUm.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\YIUm.exe
                                                                                                    • Size 2.1MB
                                                                                                    • SHA256 69a3b56b2e1d3b986e4d9ede0ececd0cdbc99e3bf64ff4484401beac63bdb63a
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    YMsW.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\YMsW.exe
                                                                                                    • Size 2.4MB
                                                                                                    • SHA256 8132ea90ddbec8298e329cc91bcd538f7822ca1485bc7049d2744127f9819435
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Ycsg.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Ycsg.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 1efa9a10ac90abd0bac1076fbe0803366581084d1063b7fb5fe1c17bf1243e37
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Ycsy.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Ycsy.exe
                                                                                                    • Size 2.2MB
                                                                                                    • SHA256 e69ae91529d0439f5644eed3feca72c07fb9ec10502ac2ce76417bafc4b087e3
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    YgQg.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\YgQg.exe
                                                                                                    • Size 1.7MB
                                                                                                    • SHA256 395292c5af02582dfd34e8533cffd9e43cd8cc58943742ef56ab9c2da02ab0f4
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    YggA.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\YggA.exe
                                                                                                    • Size 1.9MB
                                                                                                    • SHA256 e94b4e6194d51ced79fb900a09bdc64669d3de00c32e7a015e5dc36e752dca8d
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Ysww.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Ysww.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 2d16c6e80c104cdb0f61950c1721ef6915d835456a7a87a264f6dbb34b715bcd
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    aAEu.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\aAEu.exe
                                                                                                    • Size 2.2MB
                                                                                                    • SHA256 b9b41032f19e6e3933b25c9bdb055d79aeca3ab4820480ec83701749578db3e9
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    aIYS.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\aIYS.exe
                                                                                                    • Size 2.1MB
                                                                                                    • SHA256 41db29bf7c2b3a53395fe14c8dacd7fce6f8438c042aa091d11c997200f993eb
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    aIwu.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\aIwu.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 e285af930c735be0a5355f1a28fb6186fef8489b12ac45d5a2f9d78f613b6e20
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    aMUk.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\aMUk.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 4e650e2c632231ddb4f7cc00a9f7e4a169af00d64230756fa7d9ea319472fa10
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    aQQY.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\aQQY.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 1ee3f8c668bacd14a4f77218f6c8f20314d4349317a4baf7caac85f1f47a4b61
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    aUAQ.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\aUAQ.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 ff1c51e3a5a5c4e1146839346499d686c87f75508103631e5f1c29b46fe9e4c8
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    aUIK.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\aUIK.exe
                                                                                                    • Size 1.7MB
                                                                                                    • SHA256 a497da808a26dfb91128b8104661db3a3b5ed744d2012640a3bfdd56d4a8caf3
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    ackk.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ackk.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 805b1ba53b3a6a935209c3ab99872b751ff978d1fea41f1a0384719326c69772
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    cAoG.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\cAoG.exe
                                                                                                    • Size 2.0MB
                                                                                                    • SHA256 deaa4dca7eaf4d382ac435352b8fef8e7de43d0a5b86ca7cbf12fb8f0c7ab1b4
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    cIIQ.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\cIIQ.exe
                                                                                                    • Size 2.5MB
                                                                                                    • SHA256 06fd63625f62f023054ae7664f560591cd3e28242ffa7f233a4727b751177351
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    cMkY.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\cMkY.exe
                                                                                                    • Size 2.0MB
                                                                                                    • SHA256 1cb651ff768c90c4c7723bd6c8f0af154c8f877b92ade8d9c081818c2a47cea2
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    cQsY.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\cQsY.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 69c3f8408ae0a32262b1f1b4319198102b2db86f299029afcfc7ab93dad58eb8
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    cUMC.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\cUMC.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 fbd03655b66b6edf3225a09908b8efdf02e545f5dcc3115fdc3a5fd762b219a6
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    cUoc.ico
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\cUoc.ico
                                                                                                    • Size 4KB
                                                                                                    • SHA256 bc4ed7d844af9da0a5d2fe12e8db07fbfdf6e0ecd557223b292bd0e9cb6a64a1
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    cYIA.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\cYIA.exe
                                                                                                    • Size 1.8MB
                                                                                                    • SHA256 bb8fdfc71322f44c9193775d5fe9df9260ffa52b6121c5ce0c129c055219e6bf
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    ccUU.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ccUU.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 6d84cf563fa5f93b0f49caa55b8a4f4d06c3e062d8a5bb73b97068885c30d7ee
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    cgUQ.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\cgUQ.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 30e542823f391fdb4038a3545e830902fb840e4f787289336fca93989d3c7860
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    cgwo.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\cgwo.exe
                                                                                                    • Size 1.8MB
                                                                                                    • SHA256 95857ccb7404260a9c3f6ae6a2d00303370dfa7068968b09613b19c2d9caa42e
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    eIUi.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\eIUi.exe
                                                                                                    • Size 1.8MB
                                                                                                    • SHA256 b1abd1d57ace34c63e7b9f9d4cd0327a1cb5a88c8b913587db28c983da21c6e1
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    eMIC.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\eMIC.exe
                                                                                                    • Size 2.2MB
                                                                                                    • SHA256 68d68dac0c115fadc975664678e070de307d892a17628f2be9bfe745a65ad364
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    eQUg.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\eQUg.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 d0f9f3feb8abccffaed0d7a1fc70e8656f64d22e1412f6c89eb548611cab5324
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    ekEA.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ekEA.exe
                                                                                                    • Size 1.8MB
                                                                                                    • SHA256 ccc4268c8ea66381882d1015018a1e9c9e0697a2d659d76b8e6143c5e24a9fe7
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    ekEQ.ico
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ekEQ.ico
                                                                                                    • Size 4KB
                                                                                                    • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    esYw.ico
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\esYw.ico
                                                                                                    • Size 4KB
                                                                                                    • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    ewwC.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ewwC.exe
                                                                                                    • Size 2.2MB
                                                                                                    • SHA256 cee358e73a97c151c2fd51462c40b25c8db62f5fdcbcfade50289b4ba0c95ded
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    file.vbs
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                                    • Size 19B
                                                                                                    • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    gAga.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\gAga.exe
                                                                                                    • Size 2.0MB
                                                                                                    • SHA256 4f9be102dce55ec351857449f8cf628de0597d74a325cef2a3ffb04a8e78a167
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    gIUW.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\gIUW.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 f8bccceba049ad4d73d97f672d4d4d08bec303bd8fb93ea9334a1797d3265c3e
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    iEIi.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\iEIi.exe
                                                                                                    • Size 1.7MB
                                                                                                    • SHA256 0aff19f3afc1db896cd8698c17dfd695899c58301337b5ee786820103ab125c5
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    iMMU.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\iMMU.exe
                                                                                                    • Size 1.9MB
                                                                                                    • SHA256 3a54b6d88258162b977577c78450efa6a2e4e2028ef6b0a4ddc6dc40f925bfd2
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    iMYQ.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\iMYQ.exe
                                                                                                    • Size 1.9MB
                                                                                                    • SHA256 cf535724cbb5bf5c260dfca704d3b0dbf8e9a196f25327d0cd5d94a18bc0ce62
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    iQsu.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\iQsu.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 23ff19597946e56b7171db3d993e12756dbff8346655da4ac9008bd97ace8470
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    icAU.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\icAU.exe
                                                                                                    • Size 2.0MB
                                                                                                    • SHA256 11f1298b6ec379d28c2418a61829ca5ce376aac05c19c14a06bcbfe07dea7a29
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    igYc.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\igYc.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 1bc6a5633d9e92a34c0eb5668fd9de0a5a8b160d3a2be7fab4a4fe7ff7c47bd0
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    igkU.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\igkU.exe
                                                                                                    • Size 2.0MB
                                                                                                    • SHA256 3d4196503c5d540a1ce16e0ce177a7c3d0bb67b005994b17473410362c0f74cd
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    ikEK.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ikEK.exe
                                                                                                    • Size 1.8MB
                                                                                                    • SHA256 c0160168e25b0c0c5cc59b320cb8c3d934ad8555dad346c411fcc2a0c34ffd33
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    iwwU.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\iwwU.exe
                                                                                                    • Size 2.1MB
                                                                                                    • SHA256 5a28d7d07e639ae7927ad13030ea445fb7a800d3ffe8573f767df6f7e54f691c
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    kAUK.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\kAUK.exe
                                                                                                    • Size 2.0MB
                                                                                                    • SHA256 9eed32f2949876039889f91fb133cf21e8620a6d89cebde17a7dab2f303afb84
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    kUEE.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\kUEE.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 668444c5f1881de5b324aefb2724e65d47efbc22abdac89cd2ee55c8e3491059
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    kUce.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\kUce.exe
                                                                                                    • Size 2.5MB
                                                                                                    • SHA256 645cd574ed81dc4ccff1cc4e1ab83672ee2a7b889004af39b40a61cfb8907f2d
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    kUgO.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\kUgO.exe
                                                                                                    • Size 2.0MB
                                                                                                    • SHA256 e956820345e30969887014284f860271ab0a56e48f08621539f9e39c44fe0a83
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    kYsI.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\kYsI.exe
                                                                                                    • Size 2.0MB
                                                                                                    • SHA256 6b1f6a78a5a329040323d6218151be1fdea1db4bf924f71bda6b313f6d4b6bdd
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    kcgM.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\kcgM.exe
                                                                                                    • Size 1.7MB
                                                                                                    • SHA256 7e5b1d36dd5087710e57f832444d9067ba3324320a6e288faa6ff81fac531f4a
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    kego.ico
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\kego.ico
                                                                                                    • Size 4KB
                                                                                                    • SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    kwUE.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\kwUE.exe
                                                                                                    • Size 2.2MB
                                                                                                    • SHA256 db9c0798a23ef3de1058858d1cb60cfe4370c69d1c31ef40d28e378331e0abd0
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    mIIM.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\mIIM.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 07e3191846a201cce1405b16330c5ac50e6df749ddd3bef03b0dc98b270c8d97
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    mYIm.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\mYIm.exe
                                                                                                    • Size 1.7MB
                                                                                                    • SHA256 f99d1e67efe7aae079ff73ef3d5773a21e42fab70e5d31341790d5f4747741cd
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    mcEm.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\mcEm.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 06b01b05615f69e2eac6b6855192a9b345906443678917f223e1a8b943d3a4f1
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    mwcg.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\mwcg.exe
                                                                                                    • Size 2.0MB
                                                                                                    • SHA256 fa89f64abbcda8f1e7e606ad986bc2bf487ba86dcf4aa0871a9b6352bf4b78cc
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    oIMg.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\oIMg.exe
                                                                                                    • Size 2.2MB
                                                                                                    • SHA256 9aa3019c33b2c663aebf5f33bc7d1558f2b027ae233cadcc07b8d80bcd71c7f6
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    oIgA.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\oIgA.exe
                                                                                                    • Size 2.0MB
                                                                                                    • SHA256 f90d11dae6955ad7b82625a13cc498fa02d446150f6ad26555bcbba13d0a75fa
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    oUAQ.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\oUAQ.exe
                                                                                                    • Size 1.7MB
                                                                                                    • SHA256 34a527f5a8254709c1c2a44cb076e22cff0af46c2aacf4980a00b04ca148cda2
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    owkW.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\owkW.exe
                                                                                                    • Size 2.0MB
                                                                                                    • SHA256 416ef1b0168730cc820007d41dd21ab8180e573807ed7d0ac27bfac24a8971fd
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    qEkk.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\qEkk.exe
                                                                                                    • Size 2.2MB
                                                                                                    • SHA256 1647d3b3bb0b8f75ce57db5a1b5965c476e82eb9a6a215f0335b3f6f39b640b4
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    qQUo.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\qQUo.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 b98649701bb30c17c6bc122d4847ff247e56f97cbbc56eece45f90d475eb2fb7
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    qgUc.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\qgUc.exe
                                                                                                    • Size 1.9MB
                                                                                                    • SHA256 9fe0b6058c175484243f782a735f743ae14fb6c65d78102ca8c7c25abbd818cb
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    qgcI.ico
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\qgcI.ico
                                                                                                    • Size 4KB
                                                                                                    • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    qkYm.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\qkYm.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 e96f1eaa17d75de9aef2df54eb1bef0a108244c3d5c1dbda7be7124c4136cd0a
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    qkkc.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\qkkc.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 0865ca063eba4d4fcdca3518166aa8b43b2cdf32c143aff918d80321dd499fb3
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    qoYu.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\qoYu.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 0a5ef688c7db90a335489c310a0a2cd2d504ee948fabe45808fbf104e3775201
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    qsoQ.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\qsoQ.exe
                                                                                                    • Size 2.2MB
                                                                                                    • SHA256 16b97e4ce446ae8e3578ceee6e72612fe6f1ec8447a472a0d292bd175d0f9df5
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    qwwO.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\qwwO.exe
                                                                                                    • Size 1.9MB
                                                                                                    • SHA256 85f861ce706cac4c03c4cea0cac1cf0052a050674bb12cb373b3d85a56c93791
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    sMEs.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\sMEs.exe
                                                                                                    • Size 1.9MB
                                                                                                    • SHA256 947e07f6aa46f1d6ddead99b0868c27fefed7d1b8ca75f1764552c76c914ec50
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    sQko.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\sQko.exe
                                                                                                    • Size 2.1MB
                                                                                                    • SHA256 95e1498e3379906a9fdeccb3d78e2d0129c8621acf544f55d1e6e08223507fa1
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    sUEy.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\sUEy.exe
                                                                                                    • Size 2.0MB
                                                                                                    • SHA256 bec5adc5aab0db92514fe8e88f2ff2111319c3e715dc8b0b23e67528b21094dc
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    scYa.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scYa.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 679e69c17b388bdf0dc0a24a73d18063f4bda7f11ee30dc47a2b32f70b28a9d3
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    uEki.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\uEki.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 691412e848fd54e2d7f8640cf6a5d0356c5c6d4ae7acd0aaf4ecf4e0a5a1ee91
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    ugkC.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ugkC.exe
                                                                                                    • Size 1.8MB
                                                                                                    • SHA256 8c5a1e458115b14555ff39487770c671f5903d32f2e8d1b8c70689af847e70c2
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    ukEY.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ukEY.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 bb16caa2e5f1ad0ecf891c5439577501bd566effcfdfa2945dfb77abc3e2856a
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    wAoa.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\wAoa.exe
                                                                                                    • Size 2.0MB
                                                                                                    • SHA256 932420eb9a6de99478af06be83d2e9374c5cb14acbb44fc196ce00aacff54926
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    wIYS.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\wIYS.exe
                                                                                                    • Size 2.3MB
                                                                                                    • SHA256 9def62354f84a796bdce7fa0bb68b80b3919df5e8b2cec3a1ca28fba5322c052
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    wsEU.ico
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\wsEU.ico
                                                                                                    • Size 4KB
                                                                                                    • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    wwIg.ico
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\wwIg.ico
                                                                                                    • Size 4KB
                                                                                                    • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    yYIS.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\yYIS.exe
                                                                                                    • Size 1.9MB
                                                                                                    • SHA256 edfa1684263f79cbc52a3bf0efd011cdcd35e1ef852ca9e76914955e27329551
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    ycQO.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ycQO.exe
                                                                                                    • Size 2.5MB
                                                                                                    • SHA256 9f0cda01bd6a483d0016b09b9fbc57255aca49dc1f2d4cc26e0bfbd0aa57cba4
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    ycoi.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ycoi.exe
                                                                                                    • Size 2.1MB
                                                                                                    • SHA256 e36e45f02e60063d1f4a409989c72dc2d1f3d3dd7a5f891b09a71c50cb1bf89d
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    ycwi.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ycwi.exe
                                                                                                    • Size 1.8MB
                                                                                                    • SHA256 3d0049f9d3a656d0c7c2336f3253dbc0a3144d364d1c77e7670463070a849532
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    yggK.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\yggK.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 3f666f37cde9d7df17448011d63b88807c85f4b27ca47a036ffa74e02dc594fd
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    ygkE.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ygkE.exe
                                                                                                    • Size 1.9MB
                                                                                                    • SHA256 62a58542cfe03deaa28480a3125855b697339039ec64088ef35a9923f2ed14f2
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    ykgS.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ykgS.exe
                                                                                                    • Size 2.1MB
                                                                                                    • SHA256 18a7b2aa13b42d0424b0839ccccc02d886425b9735a8241958a5b088278b1e25
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.exe
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.exe
                                                                                                    • Size 1.6MB
                                                                                                    • SHA256 f177e08b87574593a8ec135d125a62797dcc069559bd4ebbdc7417735ba027e8
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 a2fbbed4f007b21c273f3cf660ce6802e971e09fec9d59878d7e9b938f3751f4
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 ebbf7352687bc2d8bd43b8217b867bb0d5349f2e6529e11b69d75e64625e97f4
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 307ed4ea92ad2c5753f19db3ef5195598a21070bd08c9d5ef1d54b68cf95a326
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 0eb8767987a28b8f925a4f042e7ac368d66b368cda14cd21f25b4c6917b125f4
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 ec1055a2ce809e519e8850c585bad7f682ac59e545623feb1b98a7a67029b62a
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 2bb53fd581e32aa4b4e12ac35bece5ef11e5a1495d5ca7354e4fb9682a3d4334
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 5aa79295e9816a60217b38b4631ba9d41c1e733ecdd1330c039b2a29abd237a1
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 e55ff9f651d614023a8e2f5195b459f6c4ab53bacb0e0fec112192cdce889532
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 6d51c05aec28712badab5826b48850e6d30ad4f6f4c9dd7501a3dac1cfb3fee6
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 3c40fb6edbcc9cc3e6a38cfd78349b2173892f69f6b01a2ed1ad810d9167672b
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 a3689e720cce414c6b87137197a2ac693b46c1f355839ec9ea4e8d90ab15d8c1
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 d7553ec89f04e1278290f8421ec13699c313c4f63cf1337770783ad429897540
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 871134bc17bdecf5b617e4957f42928e7c6a9a4422a93c5abb8763044773da0b
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 2e3458c98b3f30e2374e7b01e2a254de988d3915c112c679a8955b31fc2c4b00
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 c639114546814f7c116e291ea52282fdf782c1ed431e2089798a3ce9be735580
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 47cc95e6510acbb93d26c3a242fd30f3b769050b98056851fa71fc678675fa8b
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 748b9a2ab3a116c4fcf45c1e22382977aaa2aee8d37144a1bf4a0a031efea678
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 153e7e30ccd1013f59831d04ec5e0d6519a50ec41b108cf891da2c33a222693e
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 f4dcf5e4fee859fa4c0321e18169013c11cf5a68251828898eb2e7af44e2ae4f
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 db3c284666e58a5d5e0af9e8d1eda8804aa5d9ebb6e08e62a7556252ea063a43
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 ad03ff17f2b6737c114064fe863c2b2abbc677d0768bc006e3e06356f7b57bb2
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 688c1fb5e123e7742aee58c1bf5dfffb14c93d21be5b0591100728b6114bcd61
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 f6a2d9171d029a56b52ebc7cecfbf587a276f452619567b27b296f21866806ae
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 20a34c0b0d21cea1f77d61f626dda710291edcbf26a0dbbeb6890ab091e858f3
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 20a8e7a275a990bd406238884ff9c920744722f28fd89146ac70d46ae966e34e
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 6720471bd57da1fa0b99a3b12128d2fef47ad4c8d62cac6248d0a27b910998a3
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 3a17a2095e789358437a9ff8e1ccdc25e646dff9dbfeaa8157a6cb89d807a30e
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    XAUgMIEQ.inf
                                                                                                    • Path C:\Users\Admin\vMQgEIcE\XAUgMIEQ.inf
                                                                                                    • Size 4B
                                                                                                    • SHA256 c960d944c26c0ef290ac3fc041da811f7e1e2e1f3db3e995cff9c61652c788c3
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    memory/236-226-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/624-290-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/704-108-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/940-187-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/996-505-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1000-425-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1136-336-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1136-324-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1192-2253-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1192-20-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1236-80-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1536-716-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1592-168-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1864-1217-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2384-323-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2384-314-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2572-581-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2632-369-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2924-237-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2960-65-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3084-736-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3172-353-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3296-976-0x0000000002220000-0x0000000002240000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3296-2241-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3296-7-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3296-345-0x0000000002220000-0x0000000002240000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3324-123-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3408-761-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3408-952-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3696-312-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3768-141-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3852-211-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3956-2259-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4084-2472-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4144-2270-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4184-97-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4212-268-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4304-157-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4440-2247-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4440-16-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4592-32-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4592-0-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4592-33-0x0000000002340000-0x0000000002360000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4592-1-0x0000000002340000-0x0000000002360000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4676-202-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4696-247-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4752-1175-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4792-46-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4992-278-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5636-302-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5808-257-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5888-637-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5888-604-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                    Download