Overview

overview

10

Static

static

3

2026-08-09...ck.exe

windows10-2004-x64

10

2026-08-09...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 02:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
  • Size 1.7MB
  • Sample260809-ce4qssssbw
  • SHA256 93ebc9e5e09728bb50e79c2f29dd1dd927a7d4ec0510b9167999ed8927c9ebe9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 60 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 60 IoCs
    defense_evasiontrojan
  • Renames multiple (109) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 59 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4608
    • C:\Users\Admin\yKkUgEYA\rSYUIcgc.exe
      "C:\Users\Admin\yKkUgEYA\rSYUIcgc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of FindShellTrayWindow
      PID:4368
      • C:\ProgramData\cWEUocEU\wWUwMowA.exe
        "C:\ProgramData\cWEUocEU\wWUwMowA.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        PID:2020
    • C:\ProgramData\cWEUocEU\wWUwMowA.exe
      "C:\ProgramData\cWEUocEU\wWUwMowA.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:1360
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4156
      • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5220
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4248
          • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1292
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1588
              • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2904
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:5832
                  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:2124
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:4520
                      • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:4128
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:2872
                          • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:5680
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                              14⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:5076
                              • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:3356
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1428
                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                    17⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:2876
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:2552
                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                        19⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2664
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                          20⤵
                                            PID:1780
                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                              C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                              21⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4688
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                22⤵
                                                • Executes a command shell one-liner
                                                PID:964
                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                  23⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4840
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                    24⤵
                                                      PID:2164
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                        25⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:4280
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                          26⤵
                                                            PID:1720
                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                              27⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:5636
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                28⤵
                                                                • Executes a command shell one-liner
                                                                PID:1200
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                  29⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:3840
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                    30⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:412
                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                      31⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:4412
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                        32⤵
                                                                        • Executes a command shell one-liner
                                                                        PID:2996
                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                          33⤵
                                                                            PID:5512
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                              34⤵
                                                                                PID:4308
                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                  35⤵
                                                                                    PID:4576
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                      36⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:4048
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                        37⤵
                                                                                          PID:4652
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                            38⤵
                                                                                              PID:5420
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                39⤵
                                                                                                  PID:2056
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                    40⤵
                                                                                                    • Executes a command shell one-liner
                                                                                                    PID:1052
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                      41⤵
                                                                                                        PID:1712
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                          42⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          PID:6068
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                            43⤵
                                                                                                              PID:5320
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                44⤵
                                                                                                                  PID:1560
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                    45⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:1420
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                      46⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      PID:4228
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                        47⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:2612
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                          48⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:5404
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                            49⤵
                                                                                                                              PID:3016
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                50⤵
                                                                                                                                  PID:5052
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                    51⤵
                                                                                                                                      PID:4328
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                        52⤵
                                                                                                                                          PID:4256
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                            53⤵
                                                                                                                                              PID:4324
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                54⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:5916
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                  55⤵
                                                                                                                                                    PID:5792
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                      56⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:1008
                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                        57⤵
                                                                                                                                                          PID:5808
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                          57⤵
                                                                                                                                                            PID:4392
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                              58⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:3328
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                59⤵
                                                                                                                                                                  PID:2340
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                    60⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:6092
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                      61⤵
                                                                                                                                                                        PID:2700
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                          62⤵
                                                                                                                                                                            PID:5500
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                              63⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:4544
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                64⤵
                                                                                                                                                                                  PID:3092
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                    65⤵
                                                                                                                                                                                      PID:5928
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                        66⤵
                                                                                                                                                                                          PID:1312
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                            67⤵
                                                                                                                                                                                              PID:932
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                68⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:4588
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                  69⤵
                                                                                                                                                                                                    PID:4068
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:3388
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                        71⤵
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:1692
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                          72⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:5648
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                            73⤵
                                                                                                                                                                                                              PID:3612
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                                74⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:5732
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                                  75⤵
                                                                                                                                                                                                                    PID:2328
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                                      76⤵
                                                                                                                                                                                                                        PID:3376
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                                          77⤵
                                                                                                                                                                                                                            PID:5712
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                                              78⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:4760
                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                79⤵
                                                                                                                                                                                                                                  PID:2520
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                                                  79⤵
                                                                                                                                                                                                                                    PID:2476
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                                                      80⤵
                                                                                                                                                                                                                                        PID:4336
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                                                          81⤵
                                                                                                                                                                                                                                            PID:2032
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                                                              82⤵
                                                                                                                                                                                                                                                PID:2468
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                                                                  83⤵
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:3304
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:4536
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                                                                      85⤵
                                                                                                                                                                                                                                                        PID:5000
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                                                                          86⤵
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:3888
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                                                                            87⤵
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:1036
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                                                                              88⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:5628
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                                                                                89⤵
                                                                                                                                                                                                                                                                  PID:3872
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:4712
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                                                                                        PID:4276
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          PID:1652
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                                                                                              PID:5376
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                                                                  PID:4768
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                                                                                      PID:4140
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:4772
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                                                                                                          97⤵
                                                                                                                                                                                                                                                                                            PID:5184
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              PID:2276
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                                                                                  PID:3724
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                                                                                      PID:2756
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:4612
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:6128
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                                                                                                              PID:5068
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                                                                                                                PID:3760
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                                                                                    PID:460
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                                                                                                        PID:4968
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:552
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                                                                                                              PID:4540
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                                                                                                  PID:4456
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                                                                                                                      PID:6052
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                                                                                                                        PID:5436
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          PID:2644
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                                                                                                              PID:4732
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                PID:2696
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                                                                                                    PID:3564
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                                                                                                      PID:3096
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        PID:1972
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4480
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:3260
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4708
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4516
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5900
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                            PID:4440
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5284
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2036
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:568
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  PID:5216
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:5664
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:5188
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4924
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                118⤵
                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                PID:4976
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:956
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aQkMcAcM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5812
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5984
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                        PID:5048
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:1624
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:2396
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4036
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                    PID:5588
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AEMYYMoU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3256
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4204
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:2568
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:2324
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1356
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:824
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                        PID:2356
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mkkIwMcI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4856
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                            PID:3668
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                      PID:2036
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5924
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                        PID:4616
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HwYYMQAI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        PID:4852
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          PID:1416
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:612
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:3384
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5804
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                      PID:4628
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HwMIowUQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1152
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          PID:1060
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:4408
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:1256
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:3396
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PkcogEUw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1608
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:4092
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:1416
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:4836
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  PID:1080
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IIIMkAos.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1000
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5988
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                        PID:3572
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                  PID:1576
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:4924
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:1628
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\asYQooos.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:588
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4696
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                      PID:2400
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                PID:2976
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:3256
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                PID:1984
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uwUwwYkw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2168
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:3844
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              PID:5676
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:572
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                PID:2324
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gycwkMYk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:3912
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:1520
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                            PID:4376
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:1416
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                              PID:3188
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:1620
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bCsIYMMo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:1744
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3060
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                    PID:2980
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:4304
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1916
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3392
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:4852
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZEoUcccc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5288
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                      PID:4624
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                PID:3256
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                PID:3264
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                PID:5900
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lIMYgYoo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:4808
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5124
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                    PID:6136
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              PID:2324
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5372
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                92⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5976
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  PID:4204
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CeYAgkwU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:1868
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                    PID:5912
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              90⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:5892
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                              90⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:1620
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                              90⤵
                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                              PID:4836
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OgYoEEcI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                              90⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:4196
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                91⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                PID:6052
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                          88⤵
                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                          PID:3844
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                          88⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:3564
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                            PID:2772
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sYQkQkIQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:1876
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                              89⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                              PID:2396
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                        86⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:2748
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                        86⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4372
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                            87⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5548
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            86⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            PID:4924
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hCsQQQQQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            86⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:1976
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                87⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                PID:5184
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                          84⤵
                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                          PID:568
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                          84⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2148
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                              85⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4524
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                              84⤵
                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                              PID:4456
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZMQMwUQI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                              84⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:3364
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                85⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2988
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                  85⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                  PID:4868
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                            PID:4856
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2776
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                              82⤵
                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:1572
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NUkkooYo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                              82⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:5956
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                83⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:4580
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                          80⤵
                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                          PID:1972
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                          80⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2772
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                            PID:3432
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GkMYwQwc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:844
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                              81⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                              PID:2844
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                        78⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                        PID:988
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                        78⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:4784
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        78⤵
                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:5900
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AKokkQEc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                        78⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:3512
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                          79⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                          PID:1124
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                    76⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                    PID:2912
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                      77⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1268
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                      76⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                      PID:5372
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                        77⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:6048
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                        PID:4524
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                          77⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4244
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YmAssgME.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                          76⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:5088
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                            77⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                            PID:2976
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                      PID:5392
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3204
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                        PID:5136
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\acAcMwEs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:4340
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                          75⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                          PID:3748
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                    72⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                    PID:5924
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                    72⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:1256
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                      PID:2512
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                        73⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5140
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pOUgEIsE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                        72⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1872
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                            73⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:1400
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                              73⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                              PID:5692
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                        70⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:2356
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                          71⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5468
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                          70⤵
                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                          PID:2976
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                            71⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:3384
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            70⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            PID:956
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DqYoMwgY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            70⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:1236
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                71⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                PID:1660
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                          68⤵
                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                          PID:5124
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                          68⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2520
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            68⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            PID:5900
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JsskcsUk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            68⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:2804
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                              69⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                              PID:968
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                        66⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:5216
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                        66⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2604
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                          66⤵
                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:4244
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aYggcYgE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                          66⤵
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:556
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                            67⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                            PID:1524
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                      64⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                      PID:4812
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                      64⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                      PID:5392
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                      64⤵
                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                      PID:2776
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UWUUcAEc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                      64⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3008
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                          65⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                          PID:824
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                    62⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                    PID:1400
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                    62⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5436
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                        63⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5416
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        62⤵
                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                        PID:5804
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cqwkYcck.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                        62⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:464
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                            63⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                            PID:5244
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                      60⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                      PID:3504
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                      60⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                      PID:4448
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                        61⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3308
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        60⤵
                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                        PID:5184
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                          61⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5172
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AWQQUoIA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          PID:1516
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                            61⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                            PID:5068
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                      58⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                      PID:5900
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                      58⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:2828
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                        PID:2464
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\peIYEAAk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:5304
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                          59⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                          PID:5908
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                    PID:4708
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                    PID:4868
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                    PID:4696
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DggIMIEY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:6004
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                      57⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                      PID:1524
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                PID:5188
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:1620
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                PID:4092
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SUcoUEgE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:4052
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                  55⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                  PID:2220
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                            PID:5116
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1256
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                              52⤵
                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                              PID:2812
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KqocIUcs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                              52⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:1208
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                53⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4180
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                  53⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:2696
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                            50⤵
                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                            PID:2644
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                            50⤵
                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                            PID:844
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                            50⤵
                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                            PID:3504
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GKEkUssc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                            50⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2144
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                51⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                PID:5956
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                          48⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                          PID:4556
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                          48⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                          PID:3060
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                          48⤵
                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                          PID:5988
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VIIskAUI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                          48⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1928
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                              49⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                              PID:968
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                        46⤵
                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                        PID:824
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                        46⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4588
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                          46⤵
                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:5840
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xygMcwIA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                          46⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4416
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                              47⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                              PID:5812
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                        44⤵
                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                        PID:4052
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                        44⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1080
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                          PID:3204
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\diYMsYoI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5920
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                              45⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                              PID:3480
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                        42⤵
                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                        PID:2844
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                        42⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5804
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                          42⤵
                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                          PID:5436
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QKUUUkcw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                          42⤵
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:3360
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                            43⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                            PID:5808
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                      40⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                      PID:5184
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                      40⤵
                                                                                                                                                                                                                                                                                                                                                        PID:5460
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                        40⤵
                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                        PID:5048
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CwckocAc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                        40⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2244
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                            41⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                            PID:5500
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:1928
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                      PID:3392
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                      PID:2812
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jmwIAUEU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:3592
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                        39⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                        PID:5172
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                  36⤵
                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                  PID:5548
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                  36⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1916
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                    36⤵
                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                    PID:5020
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                      37⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1468
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pugosEQg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                      36⤵
                                                                                                                                                                                                                                                                                                                                                        PID:4460
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                          37⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                          PID:5468
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                    34⤵
                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                    PID:3360
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                    34⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4476
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                      34⤵
                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                      PID:2748
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SagcIUcg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                      34⤵
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:4780
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                        35⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                        PID:4052
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                  PID:1592
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                  PID:2132
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:2056
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oIoYswMw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:3576
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                    33⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:4516
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                              30⤵
                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                              PID:3124
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                              30⤵
                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                              PID:4036
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                              30⤵
                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                              PID:5084
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FaMgwcEw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                              30⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:4956
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                31⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1288
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                  31⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:1548
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                            28⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                            PID:1268
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                            28⤵
                                                                                                                                                                                                                                                                                                                                              PID:2520
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                              28⤵
                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                              PID:4728
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bCYkIYoI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                              28⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:3548
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                29⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                PID:2644
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                          26⤵
                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                          PID:1576
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                          26⤵
                                                                                                                                                                                                                                                                                                                                            PID:1468
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                            26⤵
                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                            PID:5548
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GOAIAwgA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                            26⤵
                                                                                                                                                                                                                                                                                                                                              PID:4200
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                27⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                PID:5140
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                          24⤵
                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                          PID:5416
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                          24⤵
                                                                                                                                                                                                                                                                                                                                            PID:4544
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                            24⤵
                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                            PID:3444
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DeQIUMIU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                            24⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            PID:3112
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                              25⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:5472
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                        22⤵
                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                        PID:1400
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                        22⤵
                                                                                                                                                                                                                                                                                                                                          PID:6048
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                          22⤵
                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                          PID:2388
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VkwIgQUI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                          22⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          PID:5060
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                            23⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                            PID:2776
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                      PID:5284
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                      PID:2056
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                      PID:5984
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hKQEIMkU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                      PID:1472
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                        21⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                        PID:4720
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                  18⤵
                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                  PID:2464
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                  18⤵
                                                                                                                                                                                                                                                                                                                                    PID:2988
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                    18⤵
                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                    PID:1288
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tOkMIIQY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                    18⤵
                                                                                                                                                                                                                                                                                                                                      PID:1508
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                        19⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                        PID:988
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                  PID:2828
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                                                                                                                                    PID:1224
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                    PID:4728
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GeYMAcsQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                    PID:5444
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                      17⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                      PID:6136
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:2980
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:5548
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                PID:3888
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MOAYAswQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                PID:2104
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                  PID:1524
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                            PID:2384
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                              PID:4324
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                              PID:4524
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cOYYMYks.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                              PID:4796
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                PID:5000
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                          PID:5276
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:2544
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                          PID:2396
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pWwkYwwA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                          PID:4172
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                            PID:3308
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                      PID:4648
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                        PID:5188
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                        PID:4180
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BSgosAkI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                        PID:4892
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:3384
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                    PID:1724
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                      PID:5760
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                      PID:4316
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zeAcwQAU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                      PID:3532
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                        PID:4688
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:4448
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                    PID:3840
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                    PID:4724
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SqQwkQwM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                    PID:5888
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                      PID:2244
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                PID:1004
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:1876
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                  PID:928
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CYoococI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                  PID:3212
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                    PID:4560
                                                                                                                                                                                                                                                                                                              • C:\ProgramData\HWAgIQME\GuAkcYco.exe
                                                                                                                                                                                                                                                                                                                C:\ProgramData\HWAgIQME\GuAkcYco.exe
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                PID:3464
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\yKkUgEYA\rSYUIcgc.exe
                                                                                                                                                                                                                                                                                                                C:\Users\Admin\yKkUgEYA\rSYUIcgc.exe
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                PID:4972
                                                                                                                                                                                                                                                                                                              • C:\ProgramData\cWEUocEU\wWUwMowA.exe
                                                                                                                                                                                                                                                                                                                C:\ProgramData\cWEUocEU\wWUwMowA.exe
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                PID:1788

                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                    Reconnaissance

                                                                                                                                                                                                                                                                                                                    Resource Development

                                                                                                                                                                                                                                                                                                                    Initial Access

                                                                                                                                                                                                                                                                                                                    Execution

                                                                                                                                                                                                                                                                                                                    Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                    T1059

                                                                                                                                                                                                                                                                                                                    Visual Basic

                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                    T1059.005

                                                                                                                                                                                                                                                                                                                    Windows Command Shell

                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                    T1059.003

                                                                                                                                                                                                                                                                                                                    Persistence

                                                                                                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                                                                                                                                                                    Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                    T1548

                                                                                                                                                                                                                                                                                                                    Bypass User Account Control

                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                    T1548.002

                                                                                                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                                                                                                                    Defense Evasion

                                                                                                                                                                                                                                                                                                                    Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                    T1548

                                                                                                                                                                                                                                                                                                                    Bypass User Account Control

                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                    T1548.002

                                                                                                                                                                                                                                                                                                                    Hide Artifacts

                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                    T1564

                                                                                                                                                                                                                                                                                                                    Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                    T1564.001

                                                                                                                                                                                                                                                                                                                    Impair Defenses

                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                    T1562

                                                                                                                                                                                                                                                                                                                    Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                    T1562.001

                                                                                                                                                                                                                                                                                                                    Modify Registry

                                                                                                                                                                                                                                                                                                                    4
                                                                                                                                                                                                                                                                                                                    T1112

                                                                                                                                                                                                                                                                                                                    Credential Access

                                                                                                                                                                                                                                                                                                                    Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                    T1555

                                                                                                                                                                                                                                                                                                                    Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                    T1555.003

                                                                                                                                                                                                                                                                                                                    Unsecured Credentials

                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                    T1552

                                                                                                                                                                                                                                                                                                                    Credentials In Files

                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                    T1552.001

                                                                                                                                                                                                                                                                                                                    Discovery

                                                                                                                                                                                                                                                                                                                    System Information Discovery

                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                    T1082

                                                                                                                                                                                                                                                                                                                    System Location Discovery

                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                    T1614

                                                                                                                                                                                                                                                                                                                    System Language Discovery

                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                    T1614.001

                                                                                                                                                                                                                                                                                                                    Lateral Movement

                                                                                                                                                                                                                                                                                                                    Collection

                                                                                                                                                                                                                                                                                                                    Data from Local System

                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                    T1005

                                                                                                                                                                                                                                                                                                                    Command and Control

                                                                                                                                                                                                                                                                                                                    Exfiltration

                                                                                                                                                                                                                                                                                                                    Impact

                                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                                    GuAkcYco.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\HWAgIQME\GuAkcYco.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 e1efccf8c3a2788664c82f7fb85e951aa1e5b5a4a9840a5cd3e0785c95e1d53b
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 464dbbff6c977a901674fa4ea87964509f5d91159eb3a399da51970cfa0d5010
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 4feed220c255d81631863b995318cfed0abbc1d147119e7a0886b2cae5e5a39d
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 31167d4d898ecb1bf8db05cd0bb27785b1a41d2e3a2f76670b872086a9dedd7f
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 1e6e06099456e5a03f1916614885793e0aab96cd105bc109b77da67e94a86775
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 5ffcbb118f3bab05f53c2ca9f66f7a46d7f6dce73d78bdee80abd71bf9431e20
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 0e06e1bc2472b3c1fdaff3b490442182ca64d987a2df0ec5ff515fc0dd3addea
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 56ad8b1a8a57f1a08606a2c697a5c7312e4410b5f93d6d3187fceb45fed47de9
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 87088d565edcc8d61c23e49e97c33b11d66d00e92af666171948b797c26778ea
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 3de743176278f98b1ae30d5424ad331f89d5e2675f19c85999fc860fc749683c
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 0ba6c9aa17c19a8683b55ae83dca2511ad64a4bb9f53ddf7be223c37b2a6a2dd
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 021fcd1d3388487819b4af1d509c8e87d609a6e237be652ae9832c7de9eab30a
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 9b6ce43551e9fd1656eda5d8aeb0b7d5354e76f539f2c4aa22542806c028baa9
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 1acd0d3e29d1bbebb67817e35013b55daf71a577ab282f5bc011145962984177
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 4549bd56f3e8aa6b89b6c14392237ec8686a7ede7dd55c79d760d39e3c2eef66
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 3babcb1512aec0d8c583e871059cfa8051541899cacbbd3bcf33c0bd7093ca68
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 7f0d4a983dabc8ff51212763b85adfa5449327f5a89afbceb85cbd09d3afd694
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 6232a82ea90de3e2c961e13ba6eebb0fffff030705289323edbf25b3dee87444
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 efcc88083a79df0e0861baabce6a9adedc38403002258ef56c032931f0277407
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 4058e3673ec89dde644ea6bb111928ca88caf1d01f126ae2d3ac86c74a55a25b
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 8787a9112b7e02bcf28adc246ae925f85b8d37a248a1a5ab74c9bf12a44b9efd
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 e3193fd063341e94e46de42954b70745411d5c85e185cd27cf2c43d99fe719ab
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 08c6f34053a29bc4cac33f5c8ced9877455d3d98ede7898aaec4d01e574106dc
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 428d08a79bc129416d366d4bbd191d05321ca0fa94d001f6d507b0b06a03d6d9
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 64bebd65d0c35f8b75a86979dd1bc42cbb4646d89dfd755a74e20e3ddd199186
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 5f56148a6c65efe24317ed9c2053414b5b38cb62eedddf655fb783bce51ad82d
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 572adacac917551a19a4d9cc86c4de074df4af1ee07e3203a43442ae03aacd4f
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 90befd8891c41430134dd500347d50176d5f6db60d4d4244f8168ba0e8d84326
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 581a0115cc4d5d5b55c8b47ff35d8e2db024ed30d037a20a2f272321eef59e78
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 30597d182880ea28b62ba44372306f016bb922578acaf87a5e81bb2433af27e0
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 1e9df115c8c2940c397a117b6f71ae5019188827396c13225f1b4392bb76af90
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 4538ae9ab6f18a6b0d65ddbe39d33668bacad02f1fb3628f9a698feef8116d40
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 be18e09097411a30de31640774ec483486194c13039731a4aa70a35073676d94
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 b88d2e87c2e194166fb2932a10d6ea9b271a5ec634847969d39d925e0287fc40
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 d8357dfecaec285fcb00b277cb786d68fe5d26811046972aae0cbc99b1d93ea6
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 b9e77394b8828e2b8a1975ec65e59a601d7e26bd9056f53af2df6ac8330694f1
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 537d52d065be33f7af1ce9781625b926103a4be9761da3438c51ac65ae8c9f34
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 8c56ace20eb73ebcb6ab79de0183a92371808fa7efe8e0a0958359c53eb96c75
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 f0c4eab8e7fac2e37d66caa25e92707e3d4e05720b639305f1338b79109adf4f
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 47a8bc0f2ae6556caf18cbcbdcda552a3fb7a7a2cac69426388f6ec6869e0b44
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 2dd73f59c80122e04df2e249697912b3cb8fdfea279f0a5e2889d60f9996a211
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 c12b86d4d21d9f9de91568e289f5ee4ab256a2a9ad3b75904dd1ea50700b8650
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 ecb77f6ab80a75a0e6ce3748a462d19ada065932429812f1a0aa1ef1f01b4611
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 2cd2f706076ef9622d79f7a9b07419ed3884e4f7699262fc04eef4bf7b002c0b
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 c6d1ccc10dd92428b660af1a723b50768d4cca900a9ebdd1f21eb4eb8aaa056a
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 edd8e115baad4bc1421e2ada1aa322ea2f3b621e1601a46df63951cb52d90680
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 b6cb789d0b288713c1d31de6281779cebd28002d4ed3c61a929d7f99b8630ffa
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 3883bde99a61ba23a23ab8f30aa0c3e8929553d7e71ba46b89505b67e63d221c
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 37e703857118b0f51fcc76eab5839df0ae51b1613e065c0b03e38d495aa7bb6f
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 d2270f92f5e2865a4d03cdd38840150d12390266f8481658341498f4c87c8074
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 d2e8eb2d70c4b85245f441fe31109501510a84bfa1f28947fc96d88eb50ff622
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 0a75d1979e92a765e99c756ec99b996c90f39275c8dbcbd530da8469c51ef0f3
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 eaaf35c9401f61738d77ce9219effe239d6258ad52d6425c2ae779b799a8ac48
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 c49fd84170aa1bc73e3dc47ca132f5ae3e0fb2b07ce5b6c46123ba692231d9e9
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 fcda4d76536e62dce5e546fcbcc6b592d90253bd5a39a5ecaa87fc63e7b0be50
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 7be25743502b19ed8da4bc007ba70963d2823ad6af4cb6aba2b2dea7f1e0f0c8
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 5d4627b9f1a6e71cfa6b27233af74f0623e516693c417819ccea4afdc836e3d2
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 0bc8099a88e7613c435d08a0e15c3aa6cfc48501b23da08f209aa5b4b0b9a07f
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 5ac716a6fdedb29c812ef1a45bb17310d1383dfaf7daf477cc0058105998afe8
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 aa54a7dc15038128e6e87fc2d0347d08364998f1cdf882558a3ef529a7837caa
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 3f40bcf94be2d570c6e0a68fb1939a7e4395d8ea30c8053e75385a7254dd986a
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 9ef1314ec80313093f5bf32fd87b9f2880afeca010b6563d52aea456ed6f28b4
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 90a9667f68a89fc73a82f0e0f4198077c9b5403cbb7ace4c15a1a9b247cf2057
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 e7594a88fd9c560ea4e08afd43110ee13e4f76ac58fba33afd67338a452f8897
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 6a951d5eb2c4fb33b1ff9cff0778200f0afee341e0a77ae2702c416a939f91ad
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 e8e0b5a59db7bf454e2aac638e0e860bc861da45ab593c15a94fbbda5ee789da
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 a75034da8a7ae7f08f09e4e7ae7fc618726da30d1534d0ac5f6f12f8fb5bada9
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 1883eec8c0f1eee5889e3db5501043d56f7b715430ac8d6c5cabe0bdb70d8a5b
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 b32048fda33644218febb78ef532c4e668efc329fdfb32c20ee5b359e174200e
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 66788166d7c4efd6de018a09981fd28f4ce89cdda25e8f99d847942f861e2ac0
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 2a29169bf424ca935f26e98c934258c15a11615fa1d98a7f1c385b6c8b129007
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 8cb7f6e18dbc8115736ba2f04ad0a52d780649e36027a77d6e853b411cc7cc07
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 32c0df35e964c3e3632a286a0254d843ace61fad06e3680e751ffab9a3c1220c
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 f4d48bb206a47280ed3cd541e9c02ce00fba40a317211b59784af11895da30b3
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 9b0a0871cf4b2e8061a7114790fa4ecf1079a795886bcef4893edb6440ebc595
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 e18c124131796daf8dcf96e9c69b836dfe72c5d5a5cdc1269e32a02d918afc67
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 92b22221a01d3f7a6420e7a64b4fd67467cb63127ea2eeafdb01bbd8ff6f779c
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 2bd28bcfbec8384dac46d4cfcd10d57320a8d2349d5312ffb6629957025ba61b
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 ebe7891592fe10c838315f39d4b5541ed5a55226f5276e10d729799c10d2a63c
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 568310b48189ddb1819880f26f06dd634ff1d4252ee830daa32b924662028d3b
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 214e5980ac66a19b3a3ec80a3fd058d7a74a18abfff1c704b95247b5dbffcba1
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 7ed9cecb169e15feba22eb851a3cab707c1c870456a516525e7e35a255d8aeef
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 061cbc21bc02a1bfb08dab60196b273ad265f152a60552a55c0dccc30ce683d9
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 14fb8b6cb909802c30275a0e5be8a47d67bf174b6461801a84e0e0101d86ad72
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 122315a68be066b4e1b5e7f3f91b3f6491ddb57db6490f20ff30973fae69c044
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 b5846dd078ba0ed2813606fd0abe1bac9abbb3f56f88fde7995edaa398ba4ab2
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 e7c961797264d23c710bb05f5f161677e6f7dfb1b6028ee7f7335735a7e60db9
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 0eb52299eb9bc56f4a523ec8b257e0af64d48ba0e797728af52d9f728b22e887
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 d9a91a6341c49526a57ed8766a2335d5656ef52fa0a2dd6771b39b417d08307a
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 fd1430402a1102c3c750db54aaba25c4f363a566999641d1c5d05baa72f6e0e1
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 e98425027bd168185ce014c989f1c5429d704fb8951a445c7cab417a1d6cf85e
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 dd316ea1f9cc8322fdb066be384aebb45a7819c8204c350e6c778b9ddc653c96
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 10294e23d0f3e03811b25418ea99ecc4cf606657660842e3b5674659eaeac370
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 118c6d2529c8bd2081ab412d711beb6fe12f6412417ae366976f0f343ae577d9
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 294822976ab6fee6ad4c749a06c633601bcebe6d4653bcd6fc91316e7d0d4d52
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 37a9d03a895ef33a3501cac0408555dfb48f7f0675e1c1af3749bd09a98524b6
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 89adf8ec1fe28dfeb871c9247833c99228cc1e029c7b81a0d1a5369d817c7158
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 12b0564a9595931610350131a5549026bf57008ff27db4ff88e6ea54c368ca2d
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 2fa2e92ab4f83a4416846f3c78b3a8b1341e3f069d418886a60e2607deb140d1
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 815d3b37c1d0b0664bf3ab03a382138a7f2dafb67b957500ca27516b178a61a9
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 5f5c4f218a14249ac63248b2777ee609a55fc0897d6be6c070743051d0320e97
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 ac63f010874efa8cf5ca45d684cd7f248d3118b6835dcdb98d4af07fddcf728d
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 b291e04da287fb037e8ce8742177daa2247698026c1fad8776ddcd06c4b3eb77
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 fe922c6c8fb3bf98fdef8b6a9a3d2a3fa5c8e0b0c669a8a88abbdae9b419f8c9
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 2350cf952ed912a81ade5d9c2bc1bcb6c8fdba95feaf1bdfe5ee17c440482667
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 64b478f39dce49062299751870de29b6c0108eebfcb090755f584c68f1e4fb12
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 d7c3cfe9ad417981330e6eb73697dd31fc5e1d46cdbf47d5815c7c585f918c50
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 182bbbfffe9042cab7e06d995c4650cc717a808f814e64678d99dec89dd6191a
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\cWEUocEU\wWUwMowA.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 2301e40339005a742a2b0c4c1cbf512f8e789f51038a37eb0763cf53986427a7
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    rqoE.txt
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\rqoE.txt
                                                                                                                                                                                                                                                                                                                    • Size 8KB
                                                                                                                                                                                                                                                                                                                    • SHA256 c56d839221d79822462865490e9d186577c218389049400db8fee8de12256848
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-08-09_f9990c88060898b1c96acce283e47745_elex_virlock
                                                                                                                                                                                                                                                                                                                    • Size 126KB
                                                                                                                                                                                                                                                                                                                    • SHA256 d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    AMAc.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\AMAc.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                    • SHA256 d076bc36c68416478511263393b5ad1f606aae0623aa3d55435a0c41ebcf1acf
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    AkYg.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\AkYg.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                    • SHA256 de4134911a6fc71b97acf2f66071bc274b9456cce23e15e425c6133caf31b37a
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    AwMY.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\AwMY.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 da1caa9bc058d028f6801e0233ca4929b5b4607f993d9d8e48bac2fb881f7953
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    CYkS.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\CYkS.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                    • SHA256 65b27082575eb6c8630c9af0bc1a588972850c0dbf47fa82122885560309f4a2
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    CgEO.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\CgEO.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                    • SHA256 a456129cc4cfcbec50d3c7f8d33c03f8701c97a293f1f9ab40295adbc1bbc049
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    CkIo.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\CkIo.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 ed497630e413659c5ca842809b78afa9066f25ea2b0ed2861ba37f070290739c
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    Ckoo.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Ckoo.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                    • SHA256 873265fdea99374390cf4ad3d1f57b3afa17fd691d3da094fa8c35aedb0f93d1
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    CoYe.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\CoYe.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                    • SHA256 4e9ecaba9e5c276363dfaf15161286e3c569631c22242acc9daefece6a78d220
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    Cscg.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Cscg.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 6cab31ae7dad5f5021e85f53d1d21a1128eca6f80bdd9d3e4d0534394c1633ca
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    EMMe.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\EMMe.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                    • SHA256 1d1a877f05ff469bea9827ef4bc3e6dc4b9e4faee56f01007afb590e939aed77
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    EQsY.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\EQsY.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                    • SHA256 b38eaa3378d61e962247173454aff94cdf528b8c803e729f0c79c70e5d9b868d
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    EowS.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\EowS.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.5MB
                                                                                                                                                                                                                                                                                                                    • SHA256 4ee8671fb5e1016ae8918427d67fb2c5612cb64bec4d0763bb094d3f5d06820c
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    GUUq.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\GUUq.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.4MB
                                                                                                                                                                                                                                                                                                                    • SHA256 963670eaba3e0a07a6c3c11359cf3ce77487069a64b1bb868aa72b44cd5fffa6
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    GYIK.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\GYIK.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                    • SHA256 2159eb501b1f9b9309dc51fa80ef5bb258be25c8d3c56315e8b7fd5ed6567579
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    GcsM.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\GcsM.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 9215c4e8c7f1b6860491da4781d39caa067120bdd73e1055bf0d0d5e3d75e334
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    GgUM.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\GgUM.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                    • SHA256 1a738012f5df02681c0b06205b78c9d8937adb0ad0deaf84ca1835cafc9e58a6
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    IAEK.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\IAEK.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 ba36971954fcee12e6a680d9a859a4172e828adf69f5cd40817577e40d26ef24
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    IAQu.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\IAQu.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 4cb76e551196c4cfc399f45b2b4f4b951938937343b40649c38562f7c92d3d5a
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    IMEy.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\IMEy.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.3MB
                                                                                                                                                                                                                                                                                                                    • SHA256 204c142e646e006da3fbd8c0d6135234632c50dd48d72b5585376453867f72c0
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    IMQw.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\IMQw.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                    • SHA256 717ba23991a8328099a87c0973628f6c879a1d9b7328c170d944b9d5da5ad45f
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    IQUI.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\IQUI.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                    • SHA256 434e38c28233371085ea169aff3916c2af261930adf7603c41b5ffbfb448c57c
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    IQsW.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\IQsW.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                    • SHA256 510013cf0efeca492e6bec0bad97850cfd179b2b46207fef2da7dec3e3ff3c4f
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    IUcQ.ico
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\IUcQ.ico
                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                    • SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    IUoy.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\IUoy.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                    • SHA256 e0e33879ae428361a5061979a30137446ed13b8b1de9dc9a80e7bafc745d1832
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    IYcq.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\IYcq.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 5f66b522f6ca7f5029c6a07fa0af3b7c2a2b9c30790adfd68c8eac4d4c3f7989
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    IocC.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\IocC.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.3MB
                                                                                                                                                                                                                                                                                                                    • SHA256 899ba3ffe624b8e5d35c00cd6ee3272d9ae5c906b1a9149b1f2227f293a85708
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    Iocq.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Iocq.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                    • SHA256 1a7eda2bdfc056d048922af2af3fe956ed2764c98dd3a5c6f29f6d922d1fba17
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    KIcy.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\KIcy.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.3MB
                                                                                                                                                                                                                                                                                                                    • SHA256 a1c35cbe95719ccfe7d96c4e8f120ba42fd3ae2ced6b2a3ad216ce9d6156a572
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    KUIC.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\KUIC.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                    • SHA256 318d8abd68f01c71236079e64253d8bbe06d97a48da14387d5adad700cd6dde1
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    Kccm.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Kccm.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 c52ef61edab717b99c2f73bdc975073d6cce3bbc700df51d9deed39a837cb606
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    KkQw.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\KkQw.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                    • SHA256 acbe6ee0c716f3aacdacd8da2a6ffcfcbcb3d57d6a82c98780444f4439acaf58
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    KoMO.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\KoMO.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                    • SHA256 2c1bf0eadda1d339a9111cebf86664c7ff8b3a13b98c9ffc20eef5e919f62cb6
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    MUsy.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\MUsy.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                    • SHA256 85ff0c34bec775c56b5d2ed32dc1c6fb28b24637019a80fd3f9f227be9def208
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    MYUg.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\MYUg.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                    • SHA256 12d153058b6a741c2854b9674649f9fb6dcdb901bbaa47cdfb7c863da066b9d6
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    McUW.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\McUW.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                    • SHA256 d2ce3d3f915bce6b8e0dfbbd3e9e82d09fb788ea02c1b84eceef883b03322a89
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    MgYg.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\MgYg.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.3MB
                                                                                                                                                                                                                                                                                                                    • SHA256 9b281613a2f90d9d1751b06d86bde83347f7c989b209bfbfec36bf7344dd9365
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    MoQm.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\MoQm.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                    • SHA256 39cbee30c626d7a36b74a18b43d26474417f14f40f5bac89a0d674ec19007a9e
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    Mswm.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Mswm.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                    • SHA256 6f0df663465c58ae4ea3995e9ef081cfcc2805c37e04f9440c651720182acfb7
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    OEQs.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\OEQs.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                    • SHA256 71cfa21d10c25673ea8440a7e83c6ccf5a9e0fb14c4d738ace3bcd0c244759f4
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    OMAK.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\OMAK.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                    • SHA256 4d8d3bcb236b0d8482b49f7972ed6398a63a930df734a9c86d0c45dc1553bce1
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    OMIQ.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\OMIQ.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 ea4bcc2d80b46cdfe4f6ffff2cdf77fbd61b9b95faf066d0561edeefea882f5e
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    OMsQ.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\OMsQ.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                    • SHA256 940122152bbeaa90dd4cc2c6b3c8401719562bdc2b958144c06d6d40d8aafa35
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    OQEI.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\OQEI.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                    • SHA256 b90c71b2fe09f97d5bb8576f4e18e88fa63bdbd1b488c0efaab37577fd55a464
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    OQwU.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\OQwU.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                    • SHA256 03e3b993090aaaac04d8fef7f6e5b157342e6628b212c01c261606ad8d2ac0f3
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    OYEy.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\OYEy.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 49dd3061be2a96043f97d58adabc78a70961d06a9a6f45106c6fc587f6abc200
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    QAQW.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\QAQW.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 e4f5eec64d7a083f28adcdfe7d562bf98dd82e4e2e64f8519bad727463818c3c
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    QEMm.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\QEMm.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 3630ef1e1803d66ae3c0c04c6f2363a64c8ed107cd0608b4665107cb4fb762dc
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    QIsA.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\QIsA.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                    • SHA256 ccce74db80e8882cd5a850505f588a61539b5bfd66058516e26c073183e55a94
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    QQAA.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\QQAA.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                    • SHA256 ddce36e2d432c40867a148a754f67d6dcf7459e45fa4dd62401182e884861b2f
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    Qkwa.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Qkwa.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                    • SHA256 039833382b7a21c5076a379fa491a9863031169654a24ce9e17fa483f41ac4e9
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    SQQq.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\SQQq.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 6917a17a954bbd83f359166f17a95ee055c33973fcb5c4e089756351ce94e6bf
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    SQkw.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\SQkw.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                    • SHA256 d5cbf3cf3558982548b629007b76464791e8bada1eb7008c310a5d8a15e6abd3
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    SUEG.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\SUEG.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                    • SHA256 decc0d13edc177acbc12ec693870804e8b68db365a2a030f99721b82fb2a02d3
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    SgAE.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\SgAE.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                    • SHA256 ba28f1f43ddfadb1e7452ac6c103f5b631a31c196c99448b8cf66362d6ed3102
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    SgAq.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\SgAq.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 7ca5e855046646a458da0f4b1dbd4402b68e682ead6c26db4c78c066910e0a2b
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    SqQwkQwM.bat
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\SqQwkQwM.bat
                                                                                                                                                                                                                                                                                                                    • Size 112B
                                                                                                                                                                                                                                                                                                                    • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    SsoW.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\SsoW.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.3MB
                                                                                                                                                                                                                                                                                                                    • SHA256 44f2d324d297d48eaf48a623eb026ba189389777a06233a3bad59650dc3957e6
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    UMQA.ico
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\UMQA.ico
                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                    • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    UQsc.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\UQsc.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                    • SHA256 f7173865fe81d7ab56134685613a1c9f3553b0facd59dd7c126bb4a733187152
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    UYoE.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\UYoE.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                    • SHA256 a240a31b017cad48c1e924e969b375b8885c08218242ba5d40ed515b65f6e517
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    UsEO.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\UsEO.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 5c578a81d538f9e7b80e4ae2abe9786ec61b74ccd0eb4885044ce15487f285c3
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    WEIQ.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\WEIQ.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 87467f8985921fe1119ecd9f7800f6be57432adff1710317d2880e43ccc27011
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    WIMU.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\WIMU.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                    • SHA256 fb9f6d0f15be475563776669ea7fa2e908edbc6f5a9b107a95a68e19228e9409
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    WUkA.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\WUkA.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                    • SHA256 4aff3682c5c60ff93cd6a300571ede728b677e9db1e8a0c65b7d73c56a37bcea
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    WUoS.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\WUoS.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                    • SHA256 fd30a7146e6d7c1a79d62481ae74a5792288bfcdfc4088973d4afc1cb748ef22
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    WgMS.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\WgMS.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                    • SHA256 5bd70217ddcea2a8cece159b90d6197ee262ff146d4c5dca5c4438501057802e
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    WoQw.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\WoQw.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                    • SHA256 3c34664633a4b18eada635900c4fa5221e3c18198f90cb0d7b0801b3b44c59e9
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    YAsm.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\YAsm.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 7cac0a5e5a6c299907423d829d4a8a499b28d8dff0eeeb5bebbc7c54444bf41c
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    YKoo.ico
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\YKoo.ico
                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                    • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    YMgO.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\YMgO.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                    • SHA256 c7fb6cc0a552cd02c0eb70c0cf015ac7e6b581954969738a56f8f60f97dbb76f
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    YYQE.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\YYQE.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 c4391f33f74bb82f30860556fd3fce254abfb62c80dc9d9180100f59294b3285
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    YwIq.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\YwIq.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                    • SHA256 9d5f71ee964119c703b81cae00dde51cfdfebe30dbe71d36548ddcabe64cb8f8
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    aUEo.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\aUEo.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                    • SHA256 2ebcf30534d0bc1fcc23296510eec85b1bc8868f14b8d5dfa43cb239e1bbe77d
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    akYY.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\akYY.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                    • SHA256 af9cff4d2a3ba3a7252183ba3cb68d47d22fa64837beeff44cddd3e13029a0a4
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    akgC.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\akgC.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                    • SHA256 2dd37a7f5e1046e4ba0aae4ea23081632f439f138d482d5033c30222fbd5e3b5
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    asEE.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\asEE.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                    • SHA256 6392d8ca75c20178d50bfa53f861e24feb9c69564733ea11670e0bd473f56fc2
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    assC.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\assC.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 14c3bc84822f72a72f52b146cb7c25fb5c6478fff74587339ed039f91f33b4c3
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    cEAg.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\cEAg.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 e4f9bb9e2db5fa33e2ca68a4b77e2fe7555e220a54bfd78c532246b53842e61b
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    cEIK.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\cEIK.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                    • SHA256 90b06b7b773f9235e314a6f4dfae9c4929fdff370da6907b255a529172efb51d
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    cMsO.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\cMsO.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                    • SHA256 86acfc130617bb212a1cf31234128d80bccac27b6bc4647e6519f0e8f2b2d79c
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    cgow.ico
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\cgow.ico
                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                    • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    cksi.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\cksi.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 f906f6c8dc42eb13a7d49412500a6e01d663a40aa48186026fdc62d4e83ebadc
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    eEou.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\eEou.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                    • SHA256 24d8f7c2a81a0667a7eea8a88c091b370e80af0aa23f899f5fe017634e7d2933
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    esQC.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\esQC.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                    • SHA256 f26e5febb9b02e4546cae7332546afec17079a4c411d80386126b84f13750459
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    file.vbs
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                                                                                                                                                                                                                                                    • Size 19B
                                                                                                                                                                                                                                                                                                                    • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    gEcG.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\gEcG.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                    • SHA256 8fec47c47ee3f2481718d95f921f62d99e74161d39cfbf0327273c952b41e98f
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    gUok.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\gUok.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                    • SHA256 13916acd9b8c82f4c44a44d2cf48d7c37156e5f3cbad206219ce9b1bcfd02762
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    ggsW.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ggsW.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                    • SHA256 748637edcc49e8ea1df0074ac538e5f18537ff91e2b71d638558bd94d227c1e2
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    gkUK.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\gkUK.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 2ddb816642c75ebcfcfc1e0dedb4c108a896da27282785f98266d66eb0f430f8
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    gwUy.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\gwUy.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                    • SHA256 9ee242633498e8145e548e1a7f7a8e9e83ff5643a2827a1e06683b4dcb73aad6
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    iAkU.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\iAkU.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                    • SHA256 34e6ae9a2986e825b24f68deebb0b31f06ea425747b09b2306605bf6365c1e86
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    iYYE.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\iYYE.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                    • SHA256 2a997fe396c79a59740b5117b6b5c8a488883f4c469c4597806a686aca56ea6b
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    igkM.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\igkM.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 51481b28f85acce09d3e803178a0b13cf4345f5d3e0f55a00e3a3c0269f6e9c3
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    ikoy.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ikoy.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 9cc2ea75c4611921ff8cfdc62c184dc1a3eabbf7ccbf6ce0085bc0b6b72dabb1
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    ioQG.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ioQG.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                    • SHA256 0fd5b44a3c1b7000091e4e926369a3c8a60bf6a528af92d70053cd0b3a6fd80d
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    isUW.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\isUW.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 858ce3acb71998a98e571de5d0d39050f72569bac44f1bd3a91fa7d00cddcb90
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    kAUO.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\kAUO.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                    • SHA256 76ecd56e2e0dcbbddb97eedeca8e3c1804eb875e8bdca9065122b2ee46fe2081
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    kIsA.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\kIsA.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                    • SHA256 162d79984d935a7b25edf1b1b96e9022e77ab47ccbb93a7327b2e56c6ae32c12
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    kMwA.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\kMwA.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 211ddc205ea475e2b91e15b1aee57cd4b5de0a95f78e20047ad5d71ed7d64ccb
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    kwUm.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\kwUm.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.4MB
                                                                                                                                                                                                                                                                                                                    • SHA256 f555a1d1dc6df2385eb0f689f5a03425007a806b8bbd4e177b8cc874979a779a
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    kwgA.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\kwgA.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                    • SHA256 38ee96b32792faba56737181153ad71e02621cd669f6e7cbbb82ab18b1ae06b0
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    mEcK.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\mEcK.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                    • SHA256 fee8cef69bc9f050506c693c651538deb02cc66509330791558ce41dc9b42da0
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    mQIK.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\mQIK.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                    • SHA256 7870581f964144f195dda21b69ec89ac793c84bcf5dc5a13635bf0aa356813fb
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    mQIU.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\mQIU.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 26fc1e78b3612051adf612208101955cd9a71dd445c05a1d7f12f8ae2547e2df
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    mUIS.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\mUIS.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                    • SHA256 f8989264353efac4e560df1b6422e84e466d172c4029161935d04351751fc978
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    mgQA.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\mgQA.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 96703cfacd44ad0c01095bb4c78a1595d164f2af27f068e513ae8bb243a7c955
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    oAEA.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\oAEA.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                    • SHA256 c63189065b7ff659f974d3db5e97229ce3ecb2ceefd14f8bdf8bb858bf88c20d
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    oEow.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\oEow.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                    • SHA256 113b4bd0a9914334f02c14e95cdef7b3b516c0445a4b6f311bc8b7c779b9ce86
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    oIMK.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\oIMK.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 10d621f0a5710e89962af666912fddd813b87ed79c0cc2dc882e20b6fa13ec51
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    oMYO.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\oMYO.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.9MB
                                                                                                                                                                                                                                                                                                                    • SHA256 4a907442e22954430692391cd06a5697542e29db2957a01f478325a75b3327ce
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    oQso.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\oQso.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                    • SHA256 820416054465fa66f78987587b638ef8ffa245d45df58dc356c1371713f05408
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    qAQi.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\qAQi.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                    • SHA256 04606d5e89bc9496c7431b947ebaedb10f1eafa3fc1b843ef0217e80df7dc1d0
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    qAUe.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\qAUe.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                    • SHA256 5a5bc2d668486bee83342dea9c6c32410f9257c7bbc44f4c344b9c985e552bf7
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    qcQi.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\qcQi.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                    • SHA256 c2a83104230db7bbcb7bce18315a8792c297b14108f9b6afd95a5b2e3e111c38
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    qmcs.ico
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\qmcs.ico
                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                    • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    sMAS.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\sMAS.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                    • SHA256 d258383c36828c5b5b26e7568f9100cecd5b508650042e48ca26f4997ce44300
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    sMgK.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\sMgK.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 387ac12f6a4ede5d0493db9c8a998fd861a7d5d2bded5a4f771aec028cd58f0d
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    sYEw.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\sYEw.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                    • SHA256 021c88022f708036b8a9dd30c4045b70621b79ad4591c6e5c2f68da935571b11
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    scEe.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scEe.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 3fe1b82eaa09a6030415232f30a089ed264c3a617cd29f38e79cd67f58c210d1
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    scUg.ico
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scUg.ico
                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                    • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    sgQg.ico
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\sgQg.ico
                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                    • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    ssMQ.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ssMQ.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                    • SHA256 c0d243310820655ae7f04c1780d0785c5b70e8ebe8b520004744a47584f9b28b
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    swYY.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\swYY.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.3MB
                                                                                                                                                                                                                                                                                                                    • SHA256 554f619bb0665d8e58f774e87785bf62e13c3aada84da00f74e8ec322d941b70
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    swkK.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\swkK.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 04463e99e400fc9e3eecd7df0d40a41a13392ae42a23c26ab7da4d9bb4bd77ff
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    uAoU.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\uAoU.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.5MB
                                                                                                                                                                                                                                                                                                                    • SHA256 1ed4cbd95a0b76c17562af99387d89aaadefd516f8ec4675ae14703f11b10306
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    uYYk.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\uYYk.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 3f1f02adbcce0b25b7bd429f779769b0883f26f7547a233670af4452317d5379
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    ukkC.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ukkC.exe
                                                                                                                                                                                                                                                                                                                    • Size 3.1MB
                                                                                                                                                                                                                                                                                                                    • SHA256 ab94301e1b9df063868be44afb74856f7f9494ae396d1834b04b655340624246
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    uoYo.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\uoYo.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                    • SHA256 097ca3b24c3489d8db1a2f868862b676cb4ece264cc424ef9f545d1e1b899cf0
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    uwMc.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\uwMc.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                    • SHA256 5f77ca3e813de5ed8b92029e1496b371833eea6c70b3bee418d0c192a5165c16
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    uwYu.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\uwYu.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                    • SHA256 0586398eab477095cf8b8ebb55897fb7387d1bdedd90e623f003ab1c10b8585b
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wEcA.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\wEcA.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                    • SHA256 bd310eebab89ea276156bdc95717dd646f91e02c0f6914051a96964f8dc3daea
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wEoI.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\wEoI.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                    • SHA256 fc456b837a0d2817cb2404671baec9b7d96eead4c7a759ff4320f3857ea00691
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wMAY.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\wMAY.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                    • SHA256 6ecc0244cf46b0d137ce87ad25aa48a7bcbfa49ce9aff91e7819e7b08c32cbd6
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wMge.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\wMge.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 148bd1a2fe7ae667022b0b843f50833cca4b4b610b1beaf98e9bf2df7c487343
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wUAU.ico
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\wUAU.ico
                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                    • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    wYYU.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\wYYU.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                    • SHA256 8768a8d0b844d81ab6ccfc329955fb8a8f2111feb430b97b784a4cb3e2f09f01
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    yAAg.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\yAAg.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                    • SHA256 35f6cf00bd0dafa7c5250c2a38436d6b6d7278eab5f5418a90be23f0818f265a
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    yEYI.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\yEYI.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 a8952b57a1292931b6285e5fe6d7c30a2973abc4d57880ef84d7a006d6c8a50d
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    yIkC.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\yIkC.exe
                                                                                                                                                                                                                                                                                                                    • Size 2.4MB
                                                                                                                                                                                                                                                                                                                    • SHA256 295d656865b7ff4dc128146857d5cbca675b76a950d57f15ef1ffa07336f57f0
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    yKIg.ico
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\yKIg.ico
                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                    • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    yQku.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\yQku.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                    • SHA256 6db05ed55c161455d3a9ce991955a1e4fa81253af800736b3c65c0d15c96e345
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    yYAg.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\yYAg.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 70f736c001dbc75c2efd0212bc360f994bc5a7889a176f0c79de8f549994a8c6
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    rSYUIcgc.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\yKkUgEYA\rSYUIcgc.exe
                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                    • SHA256 575e4b7eafb53459ecc563243ce423b3be80414c15916e85a87f98fad086570d
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\yKkUgEYA\rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 567193eaeb66b47f6f983d336f454a70773ec65783dfa354e074fab4bf387f1f
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\yKkUgEYA\rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 d42c3409973f95584bc21d281182b44fd8fbd91b2e170ff8e6692f51d3c024d9
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\yKkUgEYA\rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 60d906ce91ae909dd58d2537c8165e27c8c4981d7b85260df6c596ab9dd02935
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\yKkUgEYA\rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 961804fd600d23ab402b7b01d1a16ac4ac4ba950c486f3603e92c189a7276a8d
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\yKkUgEYA\rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 4f49e8655fb2690af6b63a0fdb53f5e0b08613bd5754e5034a1c49d6ecca4098
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\yKkUgEYA\rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 8731e71a13327a3c0e866de611cb970b0d23e9e60e516849ba695b8ea86098c3
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\yKkUgEYA\rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 edba6c8ea710fec0a5d0611c4d205f9d444c82d4d4fee930e09fada6627ab318
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\yKkUgEYA\rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 cc80b9b6176396a9fc2c853ca9c6eae42e3772bdfc0e6f1443d5e0a8081d1641
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\yKkUgEYA\rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 fb252fc9d15644ccda5c6191167eca4dcfab9913b4bc7fc72dc19a29cd00b7b8
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\yKkUgEYA\rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 cff3cfb25c964081b58fe5b2262bb63c58c2d055b8a0f0991922b0c76d9d050d
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\yKkUgEYA\rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 ecd82d08b669afea2c51d9cecdd6bed828338abed0f9229d956299e5a4a17ecb
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\yKkUgEYA\rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 e36aa6b1d2a574cb4e5bf53d55bdcfb4ae9674929bdf1971e6fb61f63c1f6877
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\yKkUgEYA\rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 9686ba57b0d76b36272580d743e53ecf55853854e42f658286e19d8dc612af8b
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\yKkUgEYA\rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 daf9770ddc20ff877891730e75542cdfb019d9bf098b5a4b3a08a7356bf31db2
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\yKkUgEYA\rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 c3f13f828da341a63b4162f27fcc79deb83b113136486204625bb8e5bf4dc78b
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\yKkUgEYA\rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 74a4a2ba5776365c577f5f4eb14734213c18d0fbc3d7b67b6b3e177ca5a4fba1
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\yKkUgEYA\rSYUIcgc.inf
                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                    • SHA256 d25447ab769e609f524d6406b70484f853fd56c96217c0ee50cc02d69bc779f1
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    memory/932-1926-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/1036-2032-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/1292-67-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/1360-2279-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/1360-16-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/1420-1807-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/1692-1949-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/1712-1786-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/1788-2292-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/2020-2429-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/2032-2000-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/2056-1775-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/2124-95-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/2328-1971-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/2340-1885-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/2476-1991-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/2612-1820-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/2664-169-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/2700-1898-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/2876-153-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/2904-81-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3016-1828-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3016-1816-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3304-2012-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3356-140-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3464-21-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3464-2286-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3612-1944-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3612-1959-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3724-2096-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3760-2119-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3840-241-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3872-2045-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4068-1939-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4128-109-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4140-2077-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4276-2055-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4280-217-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4324-1852-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4328-1842-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4368-1808-0x00000000021E0000-0x0000000002200000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4368-2273-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4368-254-0x00000000021E0000-0x0000000002200000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4368-7-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4392-1875-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4392-1858-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4412-252-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4540-2137-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4544-1907-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4576-353-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4608-35-0x0000000000AB0000-0x0000000000AD0000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4608-1-0x0000000000AB0000-0x0000000000AD0000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4608-34-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4608-0-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4612-2109-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4652-1170-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4688-184-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4840-197-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4840-180-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4968-2128-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4972-2293-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5000-2023-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5184-2087-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5220-50-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5320-1795-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5320-1782-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5376-2064-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5512-272-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5636-230-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5680-125-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5712-1980-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5792-1862-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5928-1917-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download