Overview

overview

10

Static

static

3

2026-08-15...ck.exe

windows10-2004-x64

10

2026-08-15...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/08/2026, 18:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
  • Size 1.6MB
  • Sample260815-wpcvlser4v
  • SHA256 af7164b880fe1d00822a8455372419225039918e608a72d8520d6143973fdfc5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 28 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 28 IoCs
    defense_evasiontrojan
  • Renames multiple (117) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 28 IoCs
    execution
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 56 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4680
    • C:\Users\Admin\vOcQcgUw\xaYYYUAM.exe
      "C:\Users\Admin\vOcQcgUw\xaYYYUAM.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:4640
      • C:\ProgramData\bCIwUAIU\rqgAkEUM.exe
        "C:\ProgramData\bCIwUAIU\rqgAkEUM.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        PID:5660
    • C:\ProgramData\bCIwUAIU\rqgAkEUM.exe
      "C:\ProgramData\bCIwUAIU\rqgAkEUM.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2416
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4188
      • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5636
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3060
          • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1404
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4200
              • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3900
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:2292
                  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:2556
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:3112
                      • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:3648
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:5632
                          • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                            13⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:5748
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:4968
                              • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:4776
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:1500
                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:2836
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:5996
                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                                        19⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:712
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
                                          20⤵
                                          • Executes a command shell one-liner
                                          PID:4268
                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                                            21⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5764
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
                                              22⤵
                                              • Executes a command shell one-liner
                                              PID:6056
                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
                                                C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                                                23⤵
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:4756
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  PID:4844
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                                                    25⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:3768
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      PID:1524
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                                                        27⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:1848
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          PID:5340
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                                                            29⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:1128
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              PID:4852
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                                                                31⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:5220
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:5384
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                                                                    33⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:1828
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4516
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                                                                        35⤵
                                                                          PID:4648
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
                                                                            36⤵
                                                                            • Executes a command shell one-liner
                                                                            PID:3908
                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                                                                              37⤵
                                                                                PID:5920
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
                                                                                  38⤵
                                                                                  • Executes a command shell one-liner
                                                                                  PID:912
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                                                                                    39⤵
                                                                                      PID:5248
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
                                                                                        40⤵
                                                                                        • Executes a command shell one-liner
                                                                                        PID:2508
                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                                                                                          41⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:5080
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
                                                                                            42⤵
                                                                                            • Executes a command shell one-liner
                                                                                            PID:3124
                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                                                                                              43⤵
                                                                                                PID:2564
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
                                                                                                  44⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  PID:3224
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                                                                                                    45⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:3696
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
                                                                                                      46⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:4272
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                                                                                                        47⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:4728
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
                                                                                                          48⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:1664
                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                            49⤵
                                                                                                              PID:1588
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                                                                                                              49⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:2300
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
                                                                                                                50⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                PID:988
                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  51⤵
                                                                                                                    PID:4396
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                                                                                                                    51⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:5800
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
                                                                                                                      52⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      PID:3852
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                                                                                                                        53⤵
                                                                                                                          PID:3764
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
                                                                                                                            54⤵
                                                                                                                            • Executes a command shell one-liner
                                                                                                                            PID:4764
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                                                                                                                              55⤵
                                                                                                                                PID:3288
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock"
                                                                                                                                  56⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:4292
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                  56⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  • Modifies registry key
                                                                                                                                  PID:2852
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                  56⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  • Modifies registry key
                                                                                                                                  PID:1260
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                  56⤵
                                                                                                                                  • UAC bypass
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  • Modifies registry key
                                                                                                                                  PID:4412
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oocwIwEg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                                                                                                  56⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:1584
                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                    57⤵
                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:2320
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                              54⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              • Modifies registry key
                                                                                                                              PID:3392
                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                55⤵
                                                                                                                                  PID:700
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                54⤵
                                                                                                                                • Modifies registry key
                                                                                                                                PID:3256
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                54⤵
                                                                                                                                • UAC bypass
                                                                                                                                PID:3284
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CGIQUAcM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                                                                                                54⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:5808
                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                  55⤵
                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                  PID:2876
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                            52⤵
                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                            • Modifies registry key
                                                                                                                            PID:3948
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                            52⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:1528
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                            52⤵
                                                                                                                            • UAC bypass
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:2664
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tMgkcIwE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                                                                                            52⤵
                                                                                                                            • Executes a command shell one-liner
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:2068
                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                              53⤵
                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                              PID:548
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                        50⤵
                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                        • Modifies registry key
                                                                                                                        PID:4792
                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                          51⤵
                                                                                                                            PID:124
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                          50⤵
                                                                                                                          • Modifies registry key
                                                                                                                          PID:4092
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                          50⤵
                                                                                                                          • UAC bypass
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Modifies registry key
                                                                                                                          PID:4408
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GyQAcswE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                                                                                          50⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:3716
                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                            51⤵
                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                            PID:4956
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                      48⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      • Modifies registry key
                                                                                                                      PID:1796
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                      48⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:4588
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                      48⤵
                                                                                                                      • UAC bypass
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Modifies registry key
                                                                                                                      PID:700
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BMUEYsck.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                                                                                      48⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      PID:5968
                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                        49⤵
                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:1460
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                  46⤵
                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                  PID:2384
                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                    47⤵
                                                                                                                      PID:3864
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                    46⤵
                                                                                                                    • Modifies registry key
                                                                                                                    PID:4536
                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                      47⤵
                                                                                                                        PID:2720
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                      46⤵
                                                                                                                      • UAC bypass
                                                                                                                      • Modifies registry key
                                                                                                                      PID:4248
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xCUkQksc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                                                                                      46⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:1180
                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                        47⤵
                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                        PID:5100
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                  44⤵
                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                  • Modifies registry key
                                                                                                                  PID:2024
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                  44⤵
                                                                                                                  • Modifies registry key
                                                                                                                  PID:3664
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                  44⤵
                                                                                                                  • UAC bypass
                                                                                                                  • Modifies registry key
                                                                                                                  PID:1528
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nwccgEAk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                                                                                  44⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  PID:2960
                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                    45⤵
                                                                                                                      PID:3084
                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                      45⤵
                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                      PID:5052
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                42⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                • Modifies registry key
                                                                                                                PID:600
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                42⤵
                                                                                                                • Modifies registry key
                                                                                                                PID:5668
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                42⤵
                                                                                                                • UAC bypass
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:5568
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uKYoYUII.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                                                                                42⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                PID:2936
                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                  43⤵
                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                  PID:4604
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                            40⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Modifies registry key
                                                                                                            PID:2656
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                            40⤵
                                                                                                            • Modifies registry key
                                                                                                            PID:4792
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                            40⤵
                                                                                                            • UAC bypass
                                                                                                            • Modifies registry key
                                                                                                            PID:5136
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yAogscwg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                                                                            40⤵
                                                                                                            • Executes a command shell one-liner
                                                                                                            PID:2844
                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                              41⤵
                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                              PID:124
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                        38⤵
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        PID:2532
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                        38⤵
                                                                                                        • Modifies registry key
                                                                                                        PID:4832
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                        38⤵
                                                                                                        • UAC bypass
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Modifies registry key
                                                                                                        PID:1488
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MmwEcUsg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                                                                        38⤵
                                                                                                        • Executes a command shell one-liner
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:2464
                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                          39⤵
                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                          PID:4656
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                    36⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Modifies registry key
                                                                                                    PID:4216
                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                      37⤵
                                                                                                        PID:704
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                      36⤵
                                                                                                      • Modifies registry key
                                                                                                      PID:3392
                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                        37⤵
                                                                                                          PID:3340
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                        36⤵
                                                                                                        • UAC bypass
                                                                                                        • Modifies registry key
                                                                                                        PID:5536
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lSkooIIk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                                                                        36⤵
                                                                                                        • Executes a command shell one-liner
                                                                                                        PID:3408
                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                          37⤵
                                                                                                            PID:1740
                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                            37⤵
                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                            PID:1728
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                      34⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      PID:6120
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                      34⤵
                                                                                                      • Modifies registry key
                                                                                                      PID:5380
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                      34⤵
                                                                                                      • UAC bypass
                                                                                                      • Modifies registry key
                                                                                                      PID:3316
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tcswMQgc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                                                                      34⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      PID:3876
                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                        35⤵
                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                        PID:1588
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                  32⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  PID:2960
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                  32⤵
                                                                                                  • Modifies registry key
                                                                                                  PID:3084
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                  32⤵
                                                                                                  • UAC bypass
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Modifies registry key
                                                                                                  PID:4768
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VagMUgAo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                                                                  32⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:5956
                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                    33⤵
                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                    PID:3292
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                              30⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              PID:1604
                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                31⤵
                                                                                                  PID:6136
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                30⤵
                                                                                                • Modifies registry key
                                                                                                PID:5744
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                30⤵
                                                                                                • UAC bypass
                                                                                                • Modifies registry key
                                                                                                PID:3260
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eisokEcU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                                                                30⤵
                                                                                                • Executes a command shell one-liner
                                                                                                PID:1940
                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                  31⤵
                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                  PID:3224
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                            28⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            PID:4396
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                            28⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Modifies registry key
                                                                                            PID:5424
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                            28⤵
                                                                                            • UAC bypass
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Modifies registry key
                                                                                            PID:4528
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QIsgsckk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                                                            28⤵
                                                                                            • Executes a command shell one-liner
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:1276
                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                              29⤵
                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                              PID:1216
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                        26⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        • Modifies registry key
                                                                                        PID:6048
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                        26⤵
                                                                                          PID:5828
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                          26⤵
                                                                                          • UAC bypass
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Modifies registry key
                                                                                          PID:1876
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WoQwkYwI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                                                          26⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:5408
                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                            27⤵
                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                            PID:2624
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                      24⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      • Modifies registry key
                                                                                      PID:704
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                      24⤵
                                                                                      • Modifies registry key
                                                                                      PID:2780
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                      24⤵
                                                                                      • UAC bypass
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Modifies registry key
                                                                                      PID:3340
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pwIEwIcc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                                                      24⤵
                                                                                      • Executes a command shell one-liner
                                                                                      PID:2868
                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                        25⤵
                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                        PID:3832
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                  22⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • Modifies registry key
                                                                                  PID:4084
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                  22⤵
                                                                                  • Modifies registry key
                                                                                  PID:4716
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                  22⤵
                                                                                  • UAC bypass
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Modifies registry key
                                                                                  PID:5872
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NasgkgAA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                                                  22⤵
                                                                                  • Executes a command shell one-liner
                                                                                  PID:1424
                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                    23⤵
                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                    PID:3884
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                              20⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies registry key
                                                                              PID:2640
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                              20⤵
                                                                              • Modifies registry key
                                                                              PID:3696
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                              20⤵
                                                                              • UAC bypass
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1852
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vQsQkcIc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                                              20⤵
                                                                              • Executes a command shell one-liner
                                                                              PID:1236
                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                21⤵
                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                PID:700
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                          18⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          PID:5124
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                          18⤵
                                                                          • Modifies registry key
                                                                          PID:6136
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                          18⤵
                                                                          • UAC bypass
                                                                          • Modifies registry key
                                                                          PID:1592
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gUMcggEQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                                          18⤵
                                                                          • Executes a command shell one-liner
                                                                          PID:580
                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                            19⤵
                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:2636
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                      16⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Modifies registry key
                                                                      PID:5612
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                      16⤵
                                                                      • Modifies registry key
                                                                      PID:5844
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                      16⤵
                                                                      • UAC bypass
                                                                      • Modifies registry key
                                                                      PID:4332
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gKkgMQok.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                                      16⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5092
                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                        17⤵
                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:1216
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                  14⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry key
                                                                  PID:5408
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                  14⤵
                                                                    PID:3328
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                    14⤵
                                                                    • UAC bypass
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:1876
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qesEcwAo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                                    14⤵
                                                                    • Executes a command shell one-liner
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2168
                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                      15⤵
                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                      PID:2624
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                12⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Modifies registry key
                                                                PID:4348
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                12⤵
                                                                  PID:1740
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                  12⤵
                                                                  • UAC bypass
                                                                  • Modifies registry key
                                                                  PID:2720
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dyEIgcQI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                                  12⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5348
                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                    13⤵
                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                    PID:6004
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                              10⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry key
                                                              PID:3732
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                              10⤵
                                                              • Modifies registry key
                                                              PID:3864
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                              10⤵
                                                              • UAC bypass
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry key
                                                              PID:4212
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dUUsUYYQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                              10⤵
                                                              • Executes a command shell one-liner
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1736
                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                11⤵
                                                                • Executes a VBScript file via the Windows Script Host.
                                                                PID:4668
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                          8⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Modifies registry key
                                                          PID:2476
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                          8⤵
                                                          • Modifies registry key
                                                          PID:3960
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                          8⤵
                                                          • UAC bypass
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2384
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JigkMEYY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                          8⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2368
                                                          • C:\Windows\SysWOW64\cscript.exe
                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                            9⤵
                                                            • Executes a VBScript file via the Windows Script Host.
                                                            PID:1572
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                      6⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Modifies registry key
                                                      PID:3100
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                      6⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry key
                                                      PID:4516
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                      6⤵
                                                      • UAC bypass
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry key
                                                      PID:4924
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ieEUIIIA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                      6⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1280
                                                      • C:\Windows\SysWOW64\cscript.exe
                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                        7⤵
                                                        • Executes a VBScript file via the Windows Script Host.
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1624
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                  4⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  PID:4396
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                  4⤵
                                                    PID:2356
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                    4⤵
                                                    • UAC bypass
                                                    • Modifies registry key
                                                    PID:932
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mYsIAAAM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                    4⤵
                                                    • Executes a command shell one-liner
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4624
                                                    • C:\Windows\SysWOW64\cscript.exe
                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                      5⤵
                                                      • Executes a VBScript file via the Windows Script Host.
                                                      PID:5996
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                2⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Modifies registry key
                                                PID:4792
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                • Modifies registry key
                                                PID:2068
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                2⤵
                                                • UAC bypass
                                                • Modifies registry key
                                                PID:1268
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XWQUYswU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock.exe""
                                                2⤵
                                                • Executes a command shell one-liner
                                                • Suspicious use of WriteProcessMemory
                                                PID:1224
                                                • C:\Windows\SysWOW64\cscript.exe
                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                  3⤵
                                                  • Executes a VBScript file via the Windows Script Host.
                                                  PID:5928
                                            • C:\ProgramData\hsYYcUoU\ggYwMogs.exe
                                              C:\ProgramData\hsYYcUoU\ggYwMogs.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Adds Run key to start application
                                              • Drops file in System32 directory
                                              PID:3812
                                            • C:\ProgramData\bCIwUAIU\rqgAkEUM.exe
                                              C:\ProgramData\bCIwUAIU\rqgAkEUM.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Adds Run key to start application
                                              PID:5704
                                            • C:\Users\Admin\vOcQcgUw\xaYYYUAM.exe
                                              C:\Users\Admin\vOcQcgUw\xaYYYUAM.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Adds Run key to start application
                                              • Drops file in Windows directory
                                              • Suspicious use of FindShellTrayWindow
                                              PID:240
                                            • C:\Windows\System32\sihclient.exe
                                              C:\Windows\System32\sihclient.exe /cv ZVlFFSj4mkGsP/LwdorhDg.0.2
                                              1⤵
                                                PID:4536

                                              Network

                                                    MITRE ATT&CK Enterprise v16

                                                    Reconnaissance

                                                    Resource Development

                                                    Initial Access

                                                    Execution

                                                    Command and Scripting Interpreter

                                                    2
                                                    T1059

                                                    Visual Basic

                                                    1
                                                    T1059.005

                                                    Windows Command Shell

                                                    1
                                                    T1059.003

                                                    Persistence

                                                    Boot or Logon Autostart Execution

                                                    1
                                                    T1547

                                                    Registry Run Keys / Startup Folder

                                                    1
                                                    T1547.001

                                                    Privilege Escalation

                                                    Abuse Elevation Control Mechanism

                                                    1
                                                    T1548

                                                    Bypass User Account Control

                                                    1
                                                    T1548.002

                                                    Boot or Logon Autostart Execution

                                                    1
                                                    T1547

                                                    Registry Run Keys / Startup Folder

                                                    1
                                                    T1547.001

                                                    Defense Evasion

                                                    Abuse Elevation Control Mechanism

                                                    1
                                                    T1548

                                                    Bypass User Account Control

                                                    1
                                                    T1548.002

                                                    Hide Artifacts

                                                    1
                                                    T1564

                                                    Hidden Files and Directories

                                                    1
                                                    T1564.001

                                                    Impair Defenses

                                                    1
                                                    T1562

                                                    Disable or Modify Tools

                                                    1
                                                    T1562.001

                                                    Modify Registry

                                                    4
                                                    T1112

                                                    Credential Access

                                                    Credentials from Password Stores

                                                    1
                                                    T1555

                                                    Credentials from Web Browsers

                                                    1
                                                    T1555.003

                                                    Unsecured Credentials

                                                    1
                                                    T1552

                                                    Credentials In Files

                                                    1
                                                    T1552.001

                                                    Discovery

                                                    System Information Discovery

                                                    1
                                                    T1082

                                                    System Location Discovery

                                                    1
                                                    T1614

                                                    System Language Discovery

                                                    1
                                                    T1614.001

                                                    Lateral Movement

                                                    Collection

                                                    Data from Local System

                                                    1
                                                    T1005

                                                    Command and Control

                                                    Exfiltration

                                                    Impact

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    SIMM.txt
                                                    • Path C:\ProgramData\SIMM.txt
                                                    • Size 9KB
                                                    • SHA256 cdba811bb5ef7f92177cccf22e3f2ce57adc052d1371d7eb49a60c20815e0964
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    rqgAkEUM.exe
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.exe
                                                    • Size 1.6MB
                                                    • SHA256 c493865a31c2c005e88d3b49d14ae9bbf15349dd4fa2940da26b78e4712803b9
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 deaaa44e955da43f1776fbc83ff45329b02f2acbb5c13e99de393a0318d2080c
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 9d10e7d7c56a41d5bcbb943193af84b27bc6f0141521b04e2f1016928552a714
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 c10dfc35a6d0355f22ff8d081c1a5aef521d6bd2c2e90ba81125311556fed7d7
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 757e9bed238d34bc8995ef7a6f000b9d86033658c2dab3a02b7f84505f6ad402
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 19d68ec56bffe08489a6135f88c1b855d9c21f977a31775d9fe401b4746b6193
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 a21b23e68c387b7c55a3db9e6ed2fa2943eceda53fe9ac4d1a0600327055569c
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 cc94964da8dce36d15f27c066d768bc918b25fab8eb4df5f85f656fd6587ea6d
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 f933ae19b53ee9e59bf0f7748355a6a977d976977bcc5e16333ee6dc5be4e935
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 27659bf446532802e00442e97fedbd3ddc1e70ef81385f64e087ab4f7efa3d8f
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 edd53bfa726356ab4b66ab9d6b384ca013df04dd59ba27ddca2d16f52ea42d6f
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 68d3df355b7930d916dd6d75dca257ddcbb174ee39cb9455e8257b4bc5aaacb6
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 ae849114a880b0240d2a53466ce1be0e9f8082579c17e97c7f2e0691c25844ce
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 b24fa7d1917da6ef77956a8ae5afe76be5b8e00501a751810e95145955e734d3
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 e6562aa14fbaf22f71912f189311eea1630498c469bd43377dbadba072c03070
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 1a6a9b6d97af13a3314d3f7c783b68245b29ad3b4e0e6cfb32fc4ee0935b7231
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 52f18025eed485275f191731d68da44e1852886ad9c08dd68932f9aca76049c9
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 fcf9961d3d0159ecf1756d93b2c47ca6a342cc4ea74bb51259f5ee5af36d055e
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 fa4f1d59d6ecbaa25f0488172a31d8d1325752934d4fc2cf74810441a8745933
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 eef5fb99eddb8be63c0c4d5322d43abd2516f43acad66370d4c51aa9f84dd591
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 04c47f603d51814b973f1aeb723a2f245abc01338af8b8fe30ed8395bef4fd94
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 2ce26b0b9cf64e44a8428ccf398690a9a8fa3b8ec08ea2257dea39e52796e97e
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 8b9ce5a06731dd4c0b2a4130d9cddcbc4d07741df9f0684dedacbd6a8373cc31
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 bc19ecd870c1459c5f6e4c3b5dd4365355dd7ba8502b0a4b8f2787a1f6daeca9
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 ae5cf4e846c3d2a75fa4b07fd68c490da384b98e57ddd69a0a9af84265786c9c
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 f8e7c89a784a14e0f80abe574f23bbbf3210e6e37c466191f1b7d5fda52428b6
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 1b466aaae5812f3c9527e7e610fa3fe3c0767fe3e40df8bcef01d6675264d8e9
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 9e252628aed6e5060bf8be2e1f1300fee18dee68430a9c16c0a03070e6a8a3a9
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 3541510b52aaaf051158f8c6a59bf6a79ceef5657dd9c8d480116c5a63f715d5
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 835b61678624bfb2faf6a225a135722f97776c560de7b740d7a08a1b8087bc78
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 eaabbea31f4d9e3926e2e835e0ba8993143dd7f164594053392d63d65304125d
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 c3db4137d6e58756519efa8b1f4055672ce0218c76ea00f73ddc77cb73e143c4
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 669cd1db580b6c992a95cc6a16c89fd24ca7e280cd4c2529c31f8cb5649f4e0d
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 41802f7e2a56567681fca940a9c24e8dc398358a1735db83a812ca6e774bbed4
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 283ed846c80e74becca24e0ef1bf6d8917db00cace52044c1e7a0c0d935e0ba2
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 12d6185e1002a999c66d62a132348f275e8c7019afe096f1a1fc1e48b36391d5
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 0e6840e471df837c1cc4edf34b49a10398b340a108454cbfcb18ee64f5840c8d
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 a87577ac872a16f1755fed8a8b07463e1f9a1a18047c2f6e53bcafa6fb3e1df1
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 4fcd4f37f64406cd1efa2233581f9995dff3088e785bcb05a0ba9889d5465847
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 c956db0b13e2a0a60fdf59492014c2bc77ada51d8f097f85e4901ed8edd74bcb
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 6253265a2b2c98c71064462720d039d76d1aa8fa5844e66d888569128b67ec11
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 c1ae6c723762017634d33c7ad7d115c4da03132c7339280fb456842634a11ead
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 a4f0f98a5b35dde4672688c18cdf2b1369dfcf6b417b6dee58ff53c2da153ee4
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 99ba48ced460322fa28cd0ee7593e0348827c76539fa95cab97b96602969f302
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 c63a070c0e0c795c7878ac34bc9019d46a54a475347052bf7b6a1885a9241aa8
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 ed22a39f41a063149e56876ca74267d263e1356a50bf9d0692fb155327302dbd
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 f8dbed14a92ae3c380c694d0788e9959500b7ba50bd4dfab5935161dbe6476d3
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 e809440a5c5edabf24eb3535219d43fcfe344a117bb9ac1e855285252143474e
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 2edb557093d72436a40e3ce0b34a202e45b3d8c5a963dba25bf3c67e95b40f35
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 2c348ecaf0a81da796244630b0a52d3245ab9c5ff13de6aa62413d371c1ef17c
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 6ae9761d6a6f579a3381a4df96e738ecdebe1a31094f2241f24fc925bdf8b8fa
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 98df647f3bd642f56050ba2f5ac5bec5ee466c7294dd64e9fe5eccc2123f3277
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 01c11e61a7de30942d7efebdf36660859a5db21ed61c66602f430035c18a9249
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 b997941a3e5bc810b8010ab9c762d651e8b1007b1b2e34cb143077db73dd22c4
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 509c3804b013d159caa89dfca44547601c73d3290a636c800d9c8548a204bce2
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 90545341ca2ea1827e3f59e910507b350abea63a5a482fd948003c0e76f1b969
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 09f8b874a845afb39b08348c7be520455229a20269d8fdfa194d54b26587090c
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 22b60912e23e08b3e6473a2cb5d04a0d889f79f6f60eec6ffe80216094006b7f
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 976c3c7d42da1e91c2a097b4a51a87593e504d12305f175f8184832c88a017d9
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 d342fcac4e757b557b27be1a3afe29e13166de49a76bf54037ff80abf9d535aa
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 5d0b5bcee2a5fdd723661df85631483a7ca0fff270c723ec67893dc46ca659ca
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 ced0b2539fe43293125f2d8b063f90d8d4afea2a0c9fa7d618ce349871924736
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 450e0eb7ceb47b1a2b971fec98311dce1d214813116e6b16c027ba90468f090b
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 68cff49bf5b1b469be8379a6dab5caf396202d3c39f258e41f8c797fa66f51cb
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 2e81ea2048ef3fff7c5ab476a71f9fdad271e9560033a7923475dbf97d4780df
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 5b0104a2d724aa035ab9f41f82947a3ac3ea80507d4993c5a5966cb3929ed81f
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 0fb9e858357e72117eb7b7de6d2973422b71cc3a0c5a010abca80dc99d8602fd
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 de0cee006ab30d6ca73f477150a33776392d97060eace29e9990dcd4556251ee
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 dac558e277105ea8fa0035fbf3c6bcc65be3d95e945798769279b09ec818c95c
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 e612de802e6287296132bdcde466b5b2290ca4b560b1e1b9d27bc2291b21657a
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 3ee69a018e33617c529b408d0070082883bca88a23bcdcdb41ecef83c7389a57
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 db222fe06fb051ffad9b82d8d5d5b6a8c69e036d1dff0523a9af6d8c21192306
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 5c5bb18c8a5647a4396a36f60cf91e534398bab4c3c475d74c6341af0be8d104
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 949df718e9e391961282da716d404ee4288dec0946cd1356f1501bc0e62f4b06
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 a912fbf27a7ab9c81031b5f4169a51d1ac579f5ee8a7a956b1c4876692693476
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 a129406fda43d37bb46ca36eb213c5d34f6e0cd39f04bdde5dc89426ce31965c
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 c5e79174ec850b475e4b10ac2bd384876375cb552ad53c4d064214c6ecf24a4c
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 d8ad6382e250c267eca67957bf9b68075554d3d2b1c486b6d41d4bf33d3e0e4e
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 c2fc01caee3e52cc7c5feb01793c242e00f3c1f3118b64b7f4e94eed29877355
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 bcb9e5ebebba23375dbdcc03ee227b46da50055e1b128a7b37654903f8916a85
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 6d4869e2f884475661405b3366d44ca2aa382c2a8712bd63ffad96ea5252f4ac
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 b78bacfff12f535fb0bc08e12ae5c8a1f2c75e6b9510eb1c3226c28d43824b47
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 e64648117c69219a4ff9277d91325f6fe52e78a0c64d8475647dbbda34ac3560
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 e9cef12fa632e0c45789164609766313f4645c5ead4de0005cfba61abd1cc79f
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 dfc32eafa4668fffa19ee481474ad1abc8aa6c82f2e20a4b2d9b0ad1603e925d
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 964ca1695dfdfde774d6f0b8f5b2c17a64febe5467352e4a163c9bb84c50ec60
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 30d4360087f02dc1f2e1df0cb897c0d4727779a0a7169a2b3af7419cf66ab11d
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 cf1a2a58fc1aa343eb062065f9ed21d3fc61973679d3d394ecb73edfa7b9e51c
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 444afa61933a567ca5c0f77317bdc9cd6fa34b8d4acf63c3855c15b7d3fdd0ba
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 e5a1f41b98fb4cad29f9b972698380b53c60acc13d4121e205a53f260b912f94
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 c4fdb8c8bf85bdae429b430d8b631b032cf36be6f8211d516fe9a8bb5761082f
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 a869472bf620df0a933822f2633717d1ee1e55c52600a195e98797873a208f45
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 696ff23865e8d7c6731e1ed4ec89274d2bdc5a394913e01214526aa8de68f9b5
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 7a519a14eb4922a39b41313f7d2ba795fc85eff5793be5d26b37f587774e2ddd
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 ea44d81ff15e25d406affa10bb2c5d5e850e495d7b6001e35a1757e14cbd2951
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 c9ed87ff66303f00ba4e11247d61a5ae816cad7aaffdfb75a01b1538ca53d4f8
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 c72eb224bb7067ec3477b4f9c1fdb1718751f84eca303b021e2a55f65b3a39a5
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 3da47ea84dc2488f39c3095dae8ddfbcfe0f5b3a3dbbc02ff0067cc1273749d0
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 67e8b9ab9567f2487742983357147f9f866ed5bc21f64dbc6693ffdb094ba5dc
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 81e6bf582ef36eab3aa5d950ae628bb3b0f2d7255f68d89bcb5998833d7f4ad9
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 571e8ec0c9f69b2bd514c1291e62e1dc2babf32c8d29601ade601c8592eadab0
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 6ec48e721bc57f3f3ae75b0ef88da6f3ea48ccc94252e888b07209988158f2d1
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 57945eed77a7bc6ae34828a34959f46a37f8dede9db904ca12b1256c695cdfc4
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 42235579a7b4ea966983ed3c5b3a3a2dce63349dbf32ba0e51d41bf0e0e75a2a
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rqgAkEUM.inf
                                                    • Path C:\ProgramData\bCIwUAIU\rqgAkEUM.inf
                                                    • Size 4B
                                                    • SHA256 169fa123d426d0da1d75b99fde8ad19fe1594b9d1ad7ffbbf6245ba5375a31c7
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    ggYwMogs.exe
                                                    • Path C:\ProgramData\hsYYcUoU\ggYwMogs.exe
                                                    • Size 1.6MB
                                                    • SHA256 4c5e7d2f81a706824d67e14eabe84f96372238f2a234b3babe1c52ed498117c4
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-08-15_6e22e0279dfd82a0d21d479d7e7aecee_elex_virlock
                                                    • Size 38KB
                                                    • SHA256 0f35ace5268db33940ed18e946a9c65be4e31ec0ae31faa6e60122859c5cb5ca
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    XWQUYswU.bat
                                                    • Path C:\Users\Admin\AppData\Local\Temp\XWQUYswU.bat
                                                    • Size 112B
                                                    • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    file.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                    • Size 19B
                                                    • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    xaYYYUAM.exe
                                                    • Path C:\Users\Admin\vOcQcgUw\xaYYYUAM.exe
                                                    • Size 1.6MB
                                                    • SHA256 163b01206dfdace1053a609781b07a745b26f61180cca697fbfee43647507ba6
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    xaYYYUAM.inf
                                                    • Path C:\Users\Admin\vOcQcgUw\xaYYYUAM.inf
                                                    • Size 4B
                                                    • SHA256 cee6a12846a88c968979a73095cf91155bc17657be32e626082ffa29ca311c03
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    xaYYYUAM.inf
                                                    • Path C:\Users\Admin\vOcQcgUw\xaYYYUAM.inf
                                                    • Size 4B
                                                    • SHA256 657bfe392c29b8279bacb5e3e7a56323c61aca9ca02b235f5393e65b3a62d2e7
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    xaYYYUAM.inf
                                                    • Path C:\Users\Admin\vOcQcgUw\xaYYYUAM.inf
                                                    • Size 4B
                                                    • SHA256 5beb0ed579d2c805041aa93e686c5c4ecd8a55a3236d78712830ae0031d9801e
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    xaYYYUAM.inf
                                                    • Path C:\Users\Admin\vOcQcgUw\xaYYYUAM.inf
                                                    • Size 4B
                                                    • SHA256 967195afd15b79ccd6474ea3f7f9b6314911b7747574801507d321cb0a3cdc4f
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    xaYYYUAM.inf
                                                    • Path C:\Users\Admin\vOcQcgUw\xaYYYUAM.inf
                                                    • Size 4B
                                                    • SHA256 7d2df0edbeb248aa0880a820dbed12f041927e4f2c2b944387fa1f0cef61492a
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    xaYYYUAM.inf
                                                    • Path C:\Users\Admin\vOcQcgUw\xaYYYUAM.inf
                                                    • Size 4B
                                                    • SHA256 e411689979cb8b91359df0acc2e8eee8e78a44f089fbca3b01eb16bc79701122
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    xaYYYUAM.inf
                                                    • Path C:\Users\Admin\vOcQcgUw\xaYYYUAM.inf
                                                    • Size 4B
                                                    • SHA256 888e7c6b1a79f20eeba73a790391d59cf02f9cd6165877b224a4ddea4d4dd82a
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    xaYYYUAM.inf
                                                    • Path C:\Users\Admin\vOcQcgUw\xaYYYUAM.inf
                                                    • Size 4B
                                                    • SHA256 518764f1e44623edce4354227e6aa66993c85ff083c63a3ba0db1c64c96b283e
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    xaYYYUAM.inf
                                                    • Path C:\Users\Admin\vOcQcgUw\xaYYYUAM.inf
                                                    • Size 4B
                                                    • SHA256 4c126ccd44ae5b5b9f523f1d3cf5b07a887501f0e7a8236ee16ef63b62373725
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    xaYYYUAM.inf
                                                    • Path C:\Users\Admin\vOcQcgUw\xaYYYUAM.inf
                                                    • Size 4B
                                                    • SHA256 098258573fb5a80cc126d0dcb72270166a23dde6ca93d59e0f235868731c98e4
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    xaYYYUAM.inf
                                                    • Path C:\Users\Admin\vOcQcgUw\xaYYYUAM.inf
                                                    • Size 4B
                                                    • SHA256 27bee7d08497a9c6910f60830f580aebb19222947ed08a7e866899e89a8650ab
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    xaYYYUAM.inf
                                                    • Path C:\Users\Admin\vOcQcgUw\xaYYYUAM.inf
                                                    • Size 4B
                                                    • SHA256 a86b21c4628682a3cde9980fe985ed8781d30de6ea37d6709694b5d710f12716
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    xaYYYUAM.inf
                                                    • Path C:\Users\Admin\vOcQcgUw\xaYYYUAM.inf
                                                    • Size 4B
                                                    • SHA256 0607bb13d93849fffab7612184706571c7367a3a0fd037837f2d381ee4693434
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    xaYYYUAM.inf
                                                    • Path C:\Users\Admin\vOcQcgUw\xaYYYUAM.inf
                                                    • Size 4B
                                                    • SHA256 9056a9d70f2895bfb2703c32fd8e191617fcd596aaacb729b4d781419dbac496
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    AQom.exe
                                                    • Path C:\Windows\AQom.exe
                                                    • Size 1.7MB
                                                    • SHA256 481d30381bfcc8c3d48b4c086a91e6e4ddfdd35d225cec6a2599dc0435d7e39d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    AQwy.exe
                                                    • Path C:\Windows\AQwy.exe
                                                    • Size 1.6MB
                                                    • SHA256 797bfca0ea434cc0c5062c25fa053fbd8edb925d33fa30ec0b50cf8b2836507f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    AYQS.exe
                                                    • Path C:\Windows\AYQS.exe
                                                    • Size 1.9MB
                                                    • SHA256 d7b7f7bf26897b13937b0c8ab96369c3aaf2344bf86cf94d434eb1e93c3fd835
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    CIQq.exe
                                                    • Path C:\Windows\CIQq.exe
                                                    • Size 2.2MB
                                                    • SHA256 ac0fd8191eafcee261774a4abdc66fd73ca145a2711c97b9fbc190d9b0e5ae33
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    CIww.exe
                                                    • Path C:\Windows\CIww.exe
                                                    • Size 2.0MB
                                                    • SHA256 fafed56c5df497a61b22df00d5b11a73edec0c894042a439413a7b3b598caff9
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    EAcc.exe
                                                    • Path C:\Windows\EAcc.exe
                                                    • Size 2.0MB
                                                    • SHA256 64994f544e1a3f3ac3103fa876cdd73ea8b7eab105fe686b5bbee6029df416ff
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    EIkY.ico
                                                    • Path C:\Windows\EIkY.ico
                                                    • Size 4KB
                                                    • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    EUYy.exe
                                                    • Path C:\Windows\EUYy.exe
                                                    • Size 1.9MB
                                                    • SHA256 e08bd5a0aa07fc4436a121211526c15751706f509f2c0a1a614befa4b31067f6
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    EcYO.exe
                                                    • Path C:\Windows\EcYO.exe
                                                    • Size 1.6MB
                                                    • SHA256 0a516cb9cf89ae20174ca50c0dc229e409e89dcd6055b713f539e3cbc582bb02
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    EsMg.ico
                                                    • Path C:\Windows\EsMg.ico
                                                    • Size 4KB
                                                    • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Ewsi.exe
                                                    • Path C:\Windows\Ewsi.exe
                                                    • Size 1.6MB
                                                    • SHA256 b2bcb1851ff1de2bd142f1631106392d0bbf88bf8d2461aeeb44848037cb319c
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    GAYy.exe
                                                    • Path C:\Windows\GAYy.exe
                                                    • Size 2.0MB
                                                    • SHA256 62f916e501ed99bcaa12e42add0c250f526a57723cfa1b5bbd9e179b398c5fe9
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    GkUs.exe
                                                    • Path C:\Windows\GkUs.exe
                                                    • Size 2.0MB
                                                    • SHA256 41dcf1bf2996e8023a2e40693e6b781b9986c8a363a6f12c796e22e1582d13b9
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Gsku.exe
                                                    • Path C:\Windows\Gsku.exe
                                                    • Size 1.6MB
                                                    • SHA256 671a25e6945609d1048b34c55db5142a63185f2d0d9c662d1c3cc18e2adb2d7f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    IAAi.exe
                                                    • Path C:\Windows\IAAi.exe
                                                    • Size 1.6MB
                                                    • SHA256 f4d326c7a09feae90fa93e41897384a5418fe5d0742fecc03c52e8fe80292e5e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    IAoy.exe
                                                    • Path C:\Windows\IAoy.exe
                                                    • Size 1.9MB
                                                    • SHA256 05cce7c5ad97f01ffd4bea2c5eecc69763ae368034ddff79e9c05f31b1358564
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    IEsc.exe
                                                    • Path C:\Windows\IEsc.exe
                                                    • Size 2.2MB
                                                    • SHA256 e5784ce8a1fd484389be88955a3512f9449d0260a3eac2ab963fbb2c4c966b30
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    IMwa.exe
                                                    • Path C:\Windows\IMwa.exe
                                                    • Size 1.8MB
                                                    • SHA256 b7fe2563386b6d5c85b37f0cbc1d97c64bf72695a8c4eac3c7f5eca5ef389844
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    IcUS.exe
                                                    • Path C:\Windows\IcUS.exe
                                                    • Size 2.0MB
                                                    • SHA256 1f26e784904239f93935a26e3a7aa4cb23928e2bace00b33a24d6b5b72265049
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    IgQo.exe
                                                    • Path C:\Windows\IgQo.exe
                                                    • Size 1.6MB
                                                    • SHA256 3330d8c648cae338cbd7d3faca17004cee632a894c4be22a0de0ed141b60644f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    IksS.exe
                                                    • Path C:\Windows\IksS.exe
                                                    • Size 1.6MB
                                                    • SHA256 0393e95673ad545b51511b9c7a9f4e3951a95f9f4918df3239db845a87214ca7
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    KcIg.ico
                                                    • Path C:\Windows\KcIg.ico
                                                    • Size 4KB
                                                    • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    KcMA.ico
                                                    • Path C:\Windows\KcMA.ico
                                                    • Size 4KB
                                                    • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Kgow.exe
                                                    • Path C:\Windows\Kgow.exe
                                                    • Size 1.6MB
                                                    • SHA256 225cc9ed98f3cda3116e0b66ceba5703722035094130666a43c215cb85eedca3
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    KkQm.exe
                                                    • Path C:\Windows\KkQm.exe
                                                    • Size 1.9MB
                                                    • SHA256 e890bee1c86e2b9d1a7398aeac12d1de7c4224c7cec8e09c9b442c31e01dfdaf
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Ksoy.exe
                                                    • Path C:\Windows\Ksoy.exe
                                                    • Size 1.8MB
                                                    • SHA256 9c3b2ad31fe133a602d65d01b99d39149985739d672e00968211837346e49874
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    KswK.exe
                                                    • Path C:\Windows\KswK.exe
                                                    • Size 2.0MB
                                                    • SHA256 7d9e6b7048f11996bbdebc7bba8ac1c46d35b000a66ff2c7c443a56058f28bb7
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    KwEK.exe
                                                    • Path C:\Windows\KwEK.exe
                                                    • Size 2.5MB
                                                    • SHA256 abc1317cea0325b8a7af4d76f133cf6e08cf0330e00ac65bb171fd89fca3611a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    MAMq.exe
                                                    • Path C:\Windows\MAMq.exe
                                                    • Size 1.7MB
                                                    • SHA256 de40dafbfa53b8d708eb8835cf85ec9ddb50cf32b2fde0df944863be2e0eb77a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    MIUg.exe
                                                    • Path C:\Windows\MIUg.exe
                                                    • Size 1.8MB
                                                    • SHA256 aba413bcc425df0d8dcac2359cd35d078cfa2471838f3007c781a6115ad048c8
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    MIko.exe
                                                    • Path C:\Windows\MIko.exe
                                                    • Size 1.6MB
                                                    • SHA256 ce7a04a5e969c7023a199d6219379c2b5266288d15c13f6a864f80d6a3285c12
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    MIoQ.exe
                                                    • Path C:\Windows\MIoQ.exe
                                                    • Size 1.6MB
                                                    • SHA256 b0235142f1f0bb0bd2f583dfa1d4ccba52eb230a3bab9d070f75c08ccb405db7
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    MoMe.exe
                                                    • Path C:\Windows\MoMe.exe
                                                    • Size 2.2MB
                                                    • SHA256 70ffb5386bc1646a336503ea776c3bebad2000633fae757c0ae85a2e4de12eb2
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    MokI.exe
                                                    • Path C:\Windows\MokI.exe
                                                    • Size 1.6MB
                                                    • SHA256 137fcdbcfd36ebe583a0bedbf6b04edecaa82f28526563bf534cef58242c4249
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    MwAC.exe
                                                    • Path C:\Windows\MwAC.exe
                                                    • Size 1.6MB
                                                    • SHA256 be7f54d91e847009a87a26bf83498ccafbb227bf2ead35ebbc636f79301c61cc
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    MwMG.exe
                                                    • Path C:\Windows\MwMG.exe
                                                    • Size 2.1MB
                                                    • SHA256 ca2d7992be25b3f95a0dabc749c9e1aa61425fe14f342f74e44d2511efa3fcb3
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    OIoU.exe
                                                    • Path C:\Windows\OIoU.exe
                                                    • Size 2.2MB
                                                    • SHA256 bfa11c14b5e35a1a6de39b7fab8cd542bcbb8d3b0930b99e896854cfc5883cda
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    OwUe.exe
                                                    • Path C:\Windows\OwUe.exe
                                                    • Size 2.2MB
                                                    • SHA256 750fe4b6922f0b56192f8afcd476b047a9d2881f8c83ec745cb29c4c7579c011
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    QAcc.exe
                                                    • Path C:\Windows\QAcc.exe
                                                    • Size 2.6MB
                                                    • SHA256 6d9a3aac7132d12394566e83bf70750c8e226a5a1f7b93636973d2f7ecd81689
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    QEIA.exe
                                                    • Path C:\Windows\QEIA.exe
                                                    • Size 2.2MB
                                                    • SHA256 3d2e9cbf0840b3a1608566b29365908bc882e7d04de9d847cf98f9034d0e1316
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    QEYE.exe
                                                    • Path C:\Windows\QEYE.exe
                                                    • Size 1.6MB
                                                    • SHA256 aa0bc0c6c2799905b49f5fe4c103622c01803973f123cd6cb4e0c7eba84ac127
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    QEYm.exe
                                                    • Path C:\Windows\QEYm.exe
                                                    • Size 2.0MB
                                                    • SHA256 c7e0ab616c92787701536dd1a82de43456e88484baf2bdbcec620ee0f5669d41
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    QUYq.exe
                                                    • Path C:\Windows\QUYq.exe
                                                    • Size 2.0MB
                                                    • SHA256 0b3a87abcf47646156288c86c9880ee59bba228cad5e89864eed6674910fd35c
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    QWEQ.ico
                                                    • Path C:\Windows\QWEQ.ico
                                                    • Size 4KB
                                                    • SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    QcgK.exe
                                                    • Path C:\Windows\QcgK.exe
                                                    • Size 1.6MB
                                                    • SHA256 e25ba8a8283b00031ea38175cca4db7d703222ca1e82b6b39178c16aa8378b3c
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    QsIK.exe
                                                    • Path C:\Windows\QsIK.exe
                                                    • Size 2.2MB
                                                    • SHA256 423ecbed8d11f574f8b6186204934ebfd32f5b03407553e754be3442006c8df2
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    QsMQ.exe
                                                    • Path C:\Windows\QsMQ.exe
                                                    • Size 1.8MB
                                                    • SHA256 655933f94334d349e9cee419ea139fea7fe3095451d8fd3ede0dd240dd1f3d81
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Qwck.ico
                                                    • Path C:\Windows\Qwck.ico
                                                    • Size 4KB
                                                    • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    SAUw.exe
                                                    • Path C:\Windows\SAUw.exe
                                                    • Size 1.7MB
                                                    • SHA256 1e644aa551c11f05fb41291a9c6b509e44be6454cbd09f448d4ba75103b0a975
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    SEcg.ico
                                                    • Path C:\Windows\SEcg.ico
                                                    • Size 4KB
                                                    • SHA256 5963420fd9ba8c8248e3f50d179dfa21caca8538ad1482a03f260b27cf218043
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    SMsM.exe
                                                    • Path C:\Windows\SMsM.exe
                                                    • Size 1.9MB
                                                    • SHA256 8553629dfeb707a8c724e739c3c160a352502235112f6325c51e19e74e243371
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    SYoO.exe
                                                    • Path C:\Windows\SYoO.exe
                                                    • Size 1.9MB
                                                    • SHA256 8c6cb86bdd72d3a1f139577aac435a62e4fb2744b38f0679ceb5e343a740c9ae
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    UYUK.exe
                                                    • Path C:\Windows\UYUK.exe
                                                    • Size 2.0MB
                                                    • SHA256 980cf5a1762eacc53593692622843a6ae99a51d1dc21cfd4f1f6ca164283962c
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    UcMO.exe
                                                    • Path C:\Windows\UcMO.exe
                                                    • Size 2.2MB
                                                    • SHA256 d3512ec26ca381363ddbc42b44c95f2f32985e2a22af1406ce1b42488fa66885
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    UcgS.exe
                                                    • Path C:\Windows\UcgS.exe
                                                    • Size 1.6MB
                                                    • SHA256 194a9c6eb10c4d18351051269af83c98d77e0879df08d9fab3ba5df76500c760
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    UocK.exe
                                                    • Path C:\Windows\UocK.exe
                                                    • Size 1.6MB
                                                    • SHA256 aa338b967683e4b423049e88eca60f28776f6b306137c3f034961bd922f1a8ae
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    UygQ.ico
                                                    • Path C:\Windows\UygQ.ico
                                                    • Size 4KB
                                                    • SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    WOgk.ico
                                                    • Path C:\Windows\WOgk.ico
                                                    • Size 4KB
                                                    • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    WUUs.ico
                                                    • Path C:\Windows\WUUs.ico
                                                    • Size 4KB
                                                    • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    WcEs.exe
                                                    • Path C:\Windows\WcEs.exe
                                                    • Size 1.6MB
                                                    • SHA256 abe3ef86644093dcc4d67718989cda0f0503183127e2bc6a9a6bafb6cd09ac3e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    WcIe.exe
                                                    • Path C:\Windows\WcIe.exe
                                                    • Size 1.9MB
                                                    • SHA256 a61b57b623713f63368dfc363590a725f991895c9b131c15a3f9960ae7422ab8
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Wcoe.exe
                                                    • Path C:\Windows\Wcoe.exe
                                                    • Size 2.0MB
                                                    • SHA256 6cf3a885935d0354269254e9c3fd7e6cc2e1fc918cc321e9c12768cb5736c6c7
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Wgcm.exe
                                                    • Path C:\Windows\Wgcm.exe
                                                    • Size 2.2MB
                                                    • SHA256 f523e15ad6cbfc7e6e6846ee322dcb77fa8ba065da463dca4d76c19d696bae66
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Wogg.exe
                                                    • Path C:\Windows\Wogg.exe
                                                    • Size 1.8MB
                                                    • SHA256 c4f1f85f050f048c370419bf84a93cefe347748f71707c6d75f4e0b7aaba1076
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    WwMg.exe
                                                    • Path C:\Windows\WwMg.exe
                                                    • Size 1.6MB
                                                    • SHA256 3f5db9d78f889d761e8575ce844f4b35d81da928c182ddb3253c7639d33d0100
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    WwYE.exe
                                                    • Path C:\Windows\WwYE.exe
                                                    • Size 1.7MB
                                                    • SHA256 b3885f01f010d1ffbec52e7f4665dbd101aeee0e4a4e085a26a85667c0b8ab07
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    YIQA.exe
                                                    • Path C:\Windows\YIQA.exe
                                                    • Size 1.9MB
                                                    • SHA256 3ae4d906428944942851dc9b2d114e635a9a039fb3fb534cafb1d020d7641e0a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    YMIQ.exe
                                                    • Path C:\Windows\YMIQ.exe
                                                    • Size 1.9MB
                                                    • SHA256 383e6f30811f7d997a184c06be0a2fa6cfc11b05aae1867f500dfed18db08739
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    YUom.exe
                                                    • Path C:\Windows\YUom.exe
                                                    • Size 1.9MB
                                                    • SHA256 f8b844cf353fc3b113e5d2171cf8298231947b53ff31108ab2762cfbae8fa43d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    YYYg.exe
                                                    • Path C:\Windows\YYYg.exe
                                                    • Size 1.8MB
                                                    • SHA256 f6a1eccf8d5893578829759f9beff376615c76a28dab509021ae0a8771338446
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    YowC.exe
                                                    • Path C:\Windows\YowC.exe
                                                    • Size 1.6MB
                                                    • SHA256 9dccc335b89a36e6e08b3e7eaf7bceeaa19c2e99ddaeb6b3abc0636572fbffbd
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    aAIi.exe
                                                    • Path C:\Windows\aAIi.exe
                                                    • Size 1.9MB
                                                    • SHA256 2570d71b7f5b4f1e86196ee513a9183aba05af89d289b4d6e9b06cd8b50fcca6
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    aEQq.exe
                                                    • Path C:\Windows\aEQq.exe
                                                    • Size 1.7MB
                                                    • SHA256 2daac69f7defcfcf0faf245285eb42050d5261aea61c0a46b4eee9bbbcdfabd5
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    aMMA.exe
                                                    • Path C:\Windows\aMMA.exe
                                                    • Size 1.6MB
                                                    • SHA256 40fec9a09cc9b1c78d21c1bffdc80de4468550892eeeb6d780c7179767272c48
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    aMky.exe
                                                    • Path C:\Windows\aMky.exe
                                                    • Size 1.8MB
                                                    • SHA256 7772aa9ebfc7a30153b40d5043ac66d0f7af95e1c0e1348c9d31b540600a8f7e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    aQIW.exe
                                                    • Path C:\Windows\aQIW.exe
                                                    • Size 1.6MB
                                                    • SHA256 48db3cd6df8d7b57b93c5f052754a9721209dfd66fd69c8e33ab3276bfe36158
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    acks.exe
                                                    • Path C:\Windows\acks.exe
                                                    • Size 2.1MB
                                                    • SHA256 0a1830ce45fb30e2dc15f97662dc9d79c2f9ca6fb5c7b22d6b84c62da7b3856c
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    asUU.exe
                                                    • Path C:\Windows\asUU.exe
                                                    • Size 1.6MB
                                                    • SHA256 48382413a377806f653fcf1db5e98226e5638c5672edcaac52a41b4e4438a1eb
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    cUco.exe
                                                    • Path C:\Windows\cUco.exe
                                                    • Size 1.9MB
                                                    • SHA256 792757c7f4936ae3a6f3fe2e0ecca27bb34672d65047294bc2be32e81b1667c6
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    coUK.exe
                                                    • Path C:\Windows\coUK.exe
                                                    • Size 2.1MB
                                                    • SHA256 dfb76583844e8d268b47212ce9cf28321c84f4cd56ce97291c4393c1ee9cafc7
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    csUS.exe
                                                    • Path C:\Windows\csUS.exe
                                                    • Size 2.2MB
                                                    • SHA256 55815bc8749b301aceb9c065e013c706e212a03319241a11183b386623ae3351
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    eMUs.exe
                                                    • Path C:\Windows\eMUs.exe
                                                    • Size 1.6MB
                                                    • SHA256 cae9ed36badbacb8c1eabe70cf37c80179c86624389448a1ac051e0f52d7ecd8
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    egAK.exe
                                                    • Path C:\Windows\egAK.exe
                                                    • Size 2.2MB
                                                    • SHA256 ef5e10671162acd0d9c43f9f7b864c94e954e3746099f6b051ff47a128c28bf9
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    egsU.exe
                                                    • Path C:\Windows\egsU.exe
                                                    • Size 2.0MB
                                                    • SHA256 8b12defbdea7cdc949e52dde4d35aad17b9278045ecb9bb16df1b0167ee41e12
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ewAA.ico
                                                    • Path C:\Windows\ewAA.ico
                                                    • Size 4KB
                                                    • SHA256 bc4ed7d844af9da0a5d2fe12e8db07fbfdf6e0ecd557223b292bd0e9cb6a64a1
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    gEYI.exe
                                                    • Path C:\Windows\gEYI.exe
                                                    • Size 2.1MB
                                                    • SHA256 91b5d4e1a170e785ccae352887249f67246dcf38038b9874da4e74f2a7fb86b5
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    gIQo.exe
                                                    • Path C:\Windows\gIQo.exe
                                                    • Size 2.5MB
                                                    • SHA256 4ee090ef312adaa04f661a683066a6683d743f374504aa06a1aa8dce0e2ef876
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    gYMK.exe
                                                    • Path C:\Windows\gYMK.exe
                                                    • Size 1.9MB
                                                    • SHA256 30c48a7b6764fa8d8c82dcc51a8b505e1c7773d39af1f36ce8a9d51299a2ab3c
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    gYkw.exe
                                                    • Path C:\Windows\gYkw.exe
                                                    • Size 1.6MB
                                                    • SHA256 a540187444aca4058d53fa8791d4ca955ba1db0c6f85691e6fe038ac794a9823
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ggMY.exe
                                                    • Path C:\Windows\ggMY.exe
                                                    • Size 1.6MB
                                                    • SHA256 5d60a1b4ec85a4e93f47a822e312a9134a06719dfb6a4f71f392c5c2becaa095
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    gggk.exe
                                                    • Path C:\Windows\gggk.exe
                                                    • Size 1.9MB
                                                    • SHA256 4c376f46b6a5c3291978ab63edad676d7cb27344bf42f3595fe2494091bffe58
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    goMI.exe
                                                    • Path C:\Windows\goMI.exe
                                                    • Size 2.8MB
                                                    • SHA256 3cdb1149da0d554c5a412ef872ec8585fa5d3fb3a28c6edbbd383c6a561e28cb
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    gocS.exe
                                                    • Path C:\Windows\gocS.exe
                                                    • Size 1.6MB
                                                    • SHA256 a967be8da3730212c76d15640aeb6a4a70c862e9294cec1a3e5df0f404ac1585
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    gwkK.exe
                                                    • Path C:\Windows\gwkK.exe
                                                    • Size 1.6MB
                                                    • SHA256 3a6efbb9e53a836caa9e8fac184ccb83a51db62952fbed4dc8ca1f5e9a611219
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    iEwm.exe
                                                    • Path C:\Windows\iEwm.exe
                                                    • Size 1.6MB
                                                    • SHA256 c5455f50821afa9ca356b8eabb9bcde4f0d47ea66b8781ee04f67046128540eb
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    iMEc.exe
                                                    • Path C:\Windows\iMEc.exe
                                                    • Size 1.6MB
                                                    • SHA256 ffa8f33f6baaf5d413f57fa3416ce66e94818b853273d61c421cf5ca9403f74b
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    iQca.exe
                                                    • Path C:\Windows\iQca.exe
                                                    • Size 1.6MB
                                                    • SHA256 7fd79d60be9bd489e8e40bda50255d618749c04b5be9e1247be17a6ced054280
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    iWIc.ico
                                                    • Path C:\Windows\iWIc.ico
                                                    • Size 4KB
                                                    • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    iYwo.exe
                                                    • Path C:\Windows\iYwo.exe
                                                    • Size 2.5MB
                                                    • SHA256 994011c94cca01f55a9749c1bb2eef20a26da925cff3ec66d59e44c3a76ee986
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    igUm.exe
                                                    • Path C:\Windows\igUm.exe
                                                    • Size 1.7MB
                                                    • SHA256 c066a9a7afb36d1fee6e856c297b290d56f05b16978f3a56368b9d3ae75455da
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    iwck.exe
                                                    • Path C:\Windows\iwck.exe
                                                    • Size 1.7MB
                                                    • SHA256 a0f9d111be564b3da6396e90c786e5a1c33e6dd619247603759db79feac1fc74
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    kIMw.exe
                                                    • Path C:\Windows\kIMw.exe
                                                    • Size 2.1MB
                                                    • SHA256 2c27052bdfac2598f85de0d8b24d5ac7029a986544593ca1f28458254c094c9b
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    kQUa.exe
                                                    • Path C:\Windows\kQUa.exe
                                                    • Size 1.7MB
                                                    • SHA256 f7d668719b21c30eea8de9c174d098d43679d01afe9a1498279a3736ada579c6
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    kUAU.exe
                                                    • Path C:\Windows\kUAU.exe
                                                    • Size 2.1MB
                                                    • SHA256 c1ea07f7f516b26a7fa420b54f6bede4ebe74ed7b67856ff1479eed7c07faab8
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    kcEk.exe
                                                    • Path C:\Windows\kcEk.exe
                                                    • Size 1.9MB
                                                    • SHA256 c3753bdafcc4f2e71c46eb7bfb1dac8169ba9afc813efc70647897eac79e30a8
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    kosS.exe
                                                    • Path C:\Windows\kosS.exe
                                                    • Size 1.6MB
                                                    • SHA256 0e923dda718c26be1d15bf34bfab33b83546d15f50098dfe9c7e2c0a391f7eba
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    mQse.exe
                                                    • Path C:\Windows\mQse.exe
                                                    • Size 1.6MB
                                                    • SHA256 9d62d1e278b5fe8f476960762f6177a3309681fe6658ef20aef640f56dc8bdd5
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    mUUg.exe
                                                    • Path C:\Windows\mUUg.exe
                                                    • Size 1.6MB
                                                    • SHA256 548f32b47522a0e7f74bae6bb664c715390d2f0619e60f3dbcac380c194fea4f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    mYcA.exe
                                                    • Path C:\Windows\mYcA.exe
                                                    • Size 2.1MB
                                                    • SHA256 cd4d808767119ea8ea00fd6e1c95e0a4fd6a3c349b7d3f8c4c29eef6c7e69013
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    mcQs.exe
                                                    • Path C:\Windows\mcQs.exe
                                                    • Size 1.8MB
                                                    • SHA256 5ebaf704f857ef69e5cff767d9db51f9aac1f41ad5d64f33ca4dede998d8f969
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    mksG.exe
                                                    • Path C:\Windows\mksG.exe
                                                    • Size 3.1MB
                                                    • SHA256 a5636594686195ae049bc07ba9e3f80b4a899316ac251ed158a66105cd66e02e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    moku.exe
                                                    • Path C:\Windows\moku.exe
                                                    • Size 2.3MB
                                                    • SHA256 9cc8d6919b11614c0cc5b515ee3a072387469a4d1b8bb2c628452ebacde3ee6b
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    oAIE.exe
                                                    • Path C:\Windows\oAIE.exe
                                                    • Size 2.0MB
                                                    • SHA256 49cd82635e74229f95dce6915c9fb082acea15e7100f27d3cfbee2f52babad31
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    oYIy.exe
                                                    • Path C:\Windows\oYIy.exe
                                                    • Size 1.8MB
                                                    • SHA256 3e3d4c0e6a67047c210efd0f13ac9092c25a24186ceef01680c7e6ce73f1b81b
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ocoY.exe
                                                    • Path C:\Windows\ocoY.exe
                                                    • Size 2.0MB
                                                    • SHA256 3831ff7fde3af3f779806a2d6e07ccca9b6a20ba5a82f9103c059ee4411c6016
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    osEo.exe
                                                    • Path C:\Windows\osEo.exe
                                                    • Size 2.1MB
                                                    • SHA256 a97468e1fa1154dc767b6f25c74a738f8cc10ab0c95d3893420cb4a90ae173a6
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    qAAQ.exe
                                                    • Path C:\Windows\qAAQ.exe
                                                    • Size 2.1MB
                                                    • SHA256 e9800ae975bca0087abcc017f7e94df0a2063311f7601c53f17fbb7a4b76dbdb
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    qMoW.exe
                                                    • Path C:\Windows\qMoW.exe
                                                    • Size 1.9MB
                                                    • SHA256 6b40131bbcea5b42f595f09e74b16656c8c583cb65ad537d854999e75e254a64
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    qcIm.exe
                                                    • Path C:\Windows\qcIm.exe
                                                    • Size 1.9MB
                                                    • SHA256 9eb4a73959e2e6b98cfc6bc898ab40f84780f3c8b3b0d7972af3f68bf0ef83f6
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    qckE.exe
                                                    • Path C:\Windows\qckE.exe
                                                    • Size 1.6MB
                                                    • SHA256 5e35148e4dcbdaab52127e099e2dd7a6ded84600305a536eb921a68ff5e7a8fe
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    qooI.exe
                                                    • Path C:\Windows\qooI.exe
                                                    • Size 2.0MB
                                                    • SHA256 d04d9fab4d9bacc4a7407e6647052bc4d1df3b57273565183a7398d14f50501d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    qwgI.exe
                                                    • Path C:\Windows\qwgI.exe
                                                    • Size 2.2MB
                                                    • SHA256 841e802d85e3952b3d84e925776ed4219098642e49fe2ec5180fd258f6331781
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    sMEW.exe
                                                    • Path C:\Windows\sMEW.exe
                                                    • Size 2.0MB
                                                    • SHA256 34b8c40b18f5a2ffb2b17057a69bc69dcc3311c58bc3801f53d12c74d4db2410
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    sYUC.exe
                                                    • Path C:\Windows\sYUC.exe
                                                    • Size 1.8MB
                                                    • SHA256 325773b819f9fc1b5c3866f069c88e8b06dec208841e1e1eb43403307ba75d33
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    scUq.exe
                                                    • Path C:\Windows\scUq.exe
                                                    • Size 1.9MB
                                                    • SHA256 0815f4b48a4ccf38d9a2716c721046843b4786a9b6c13d4f4201936a36f1445a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    scca.exe
                                                    • Path C:\Windows\scca.exe
                                                    • Size 2.0MB
                                                    • SHA256 ea6d2b47f8988e1624891e724d50abaa56a6e0054ed48f03afda39eb3104b25c
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    sgwY.exe
                                                    • Path C:\Windows\sgwY.exe
                                                    • Size 1.8MB
                                                    • SHA256 f6a96f5c9bbda07ff5409b73b819ab9502543fa07f48de0f0a64d5ddfd1094bd
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    skYW.exe
                                                    • Path C:\Windows\skYW.exe
                                                    • Size 1.6MB
                                                    • SHA256 5f3a0b32798f78584eb974d005b3076b86b7cb18627831956c29300e47fe2b66
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    sksq.exe
                                                    • Path C:\Windows\sksq.exe
                                                    • Size 1.9MB
                                                    • SHA256 07eac2cc9c435b2035a1a612aed7cc6d9def31475952fd3cc47af6571d664f36
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    soUa.exe
                                                    • Path C:\Windows\soUa.exe
                                                    • Size 1.7MB
                                                    • SHA256 da608d259ee0e5171908ac4049467fcb4ae40cb9469e9cd1a7c2ff03ccaa1db8
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ssQw.exe
                                                    • Path C:\Windows\ssQw.exe
                                                    • Size 1.6MB
                                                    • SHA256 18e4068148103f7655d01c3931684afcb5906967323a77091256daa94c8bab83
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    uAEQ.exe
                                                    • Path C:\Windows\uAEQ.exe
                                                    • Size 2.0MB
                                                    • SHA256 585dc399b72edf18c784467a0900f6cec3b49e7dc9ceaff50113c0e85310b3c1
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    uAQi.exe
                                                    • Path C:\Windows\uAQi.exe
                                                    • Size 2.3MB
                                                    • SHA256 21f93adb4d188ee87bab631b247fd0f4a9cf826643fba1c6aa397f4be3b65e89
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    uAUW.exe
                                                    • Path C:\Windows\uAUW.exe
                                                    • Size 2.3MB
                                                    • SHA256 26fdfb8ad9eda3415e372c39b08636e07076f4f711ed4f4de757d235d80955b1
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    uEYA.exe
                                                    • Path C:\Windows\uEYA.exe
                                                    • Size 1.8MB
                                                    • SHA256 b9139859269e9ded817f4aa7d087669f9bbacd3083b1404bc7abc74f61f60692
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    uIYU.exe
                                                    • Path C:\Windows\uIYU.exe
                                                    • Size 2.7MB
                                                    • SHA256 b14fa5bb0fedafffb5d3a56bd3542e01e6910f5dc3f5eff2db2ca28dd7eb1a95
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    uYca.exe
                                                    • Path C:\Windows\uYca.exe
                                                    • Size 2.5MB
                                                    • SHA256 be04f95621ef5d6a82b0f9fed89bf139a9205280be1e9b9a78bfee96a34bc749
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ugMK.exe
                                                    • Path C:\Windows\ugMK.exe
                                                    • Size 1.6MB
                                                    • SHA256 e4c32d12922571c12c3b2f47bccbc51d32945b0e228046433a0ea4e6b6d4f37a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    uowg.exe
                                                    • Path C:\Windows\uowg.exe
                                                    • Size 1.6MB
                                                    • SHA256 abe8160d4f2d7146afda8f44fcc436c40f2349a2fb2fe1783c533152a355fd1c
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    uwAY.exe
                                                    • Path C:\Windows\uwAY.exe
                                                    • Size 1.8MB
                                                    • SHA256 415c1203745f71c887bdd62305f8325c18b62f8b71c6e0928a791a44c8dcd42e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    uwAc.exe
                                                    • Path C:\Windows\uwAc.exe
                                                    • Size 2.1MB
                                                    • SHA256 0f8b1e19ed4bcd792becc9ef20e4bbe56c2c2ff24fc4f4b24fd9e569aed27d8a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    uwkS.exe
                                                    • Path C:\Windows\uwkS.exe
                                                    • Size 2.0MB
                                                    • SHA256 8c8733054642436791ff2aa25502d8dfef598b52b44ac7b528323e96b2321460
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    wAQq.exe
                                                    • Path C:\Windows\wAQq.exe
                                                    • Size 2.2MB
                                                    • SHA256 d8a8fa881bcd8c9f1f9de582942d62a098a28d0dec3a44e273a4b5a44898a1a9
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    wIoG.exe
                                                    • Path C:\Windows\wIoG.exe
                                                    • Size 2.2MB
                                                    • SHA256 5c9f1cac64d46c3ec51e3b16af841daec657784679d4907e8a1d536d53fc971d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    wMsO.exe
                                                    • Path C:\Windows\wMsO.exe
                                                    • Size 2.0MB
                                                    • SHA256 95d123217e5f1e424ac96d24e1f0df375d1d1b48a93433b62c48279f950bd2b5
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    wSco.ico
                                                    • Path C:\Windows\wSco.ico
                                                    • Size 4KB
                                                    • SHA256 9a233711400b52fc399d16bb7e3937772c44d7841a24a685467e19dfa57769d5
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    wUMa.exe
                                                    • Path C:\Windows\wUMa.exe
                                                    • Size 2.5MB
                                                    • SHA256 d011d026c3b27820a17c160e35a5f4c7f88cd447b724d9e3f6bdf33a3426e3e4
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    wewQ.ico
                                                    • Path C:\Windows\wewQ.ico
                                                    • Size 4KB
                                                    • SHA256 114dae4c54ca426f78e50998727dac92942261d71ca5b2dbaf413794dcf8ad82
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    wgse.exe
                                                    • Path C:\Windows\wgse.exe
                                                    • Size 2.4MB
                                                    • SHA256 8720a764067d72c4852705ed567d4a7322e47c72db0a29751bf4cea93fee0025
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    wkEy.exe
                                                    • Path C:\Windows\wkEy.exe
                                                    • Size 2.1MB
                                                    • SHA256 4c7e9eefc385285049f40b6cbeb69cf046e1ff39e9cb1144141f72ee7544c2b5
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    wkMS.exe
                                                    • Path C:\Windows\wkMS.exe
                                                    • Size 1.6MB
                                                    • SHA256 ddb883531bbce638d94d513a08d22b2fc2487d324b0d04001dcd6cf9428719c2
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    yMIS.exe
                                                    • Path C:\Windows\yMIS.exe
                                                    • Size 2.1MB
                                                    • SHA256 af481b6270adb82a6412f8e1e10758838700daa1114f15d8528af699746bbc83
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    yYwQ.exe
                                                    • Path C:\Windows\yYwQ.exe
                                                    • Size 2.0MB
                                                    • SHA256 cf1a10b02c66bb95e67c7166299b418d19d7bbd6122a472867e6dfda6f960f4a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ygoY.exe
                                                    • Path C:\Windows\ygoY.exe
                                                    • Size 1.7MB
                                                    • SHA256 ab05c955626b075f88e878e505b6a8d29ad08d946ce9c28d3b4eca91b5c77727
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ykcM.ico
                                                    • Path C:\Windows\ykcM.ico
                                                    • Size 4KB
                                                    • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ykkE.exe
                                                    • Path C:\Windows\ykkE.exe
                                                    • Size 1.7MB
                                                    • SHA256 34bc75a6b74b94c36a0ba18afcf34e1810233dc435c4c9541f258fdf5227df5a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ywYa.exe
                                                    • Path C:\Windows\ywYa.exe
                                                    • Size 2.1MB
                                                    • SHA256 0e77553eb6e120dbba7bf4aaf78e1f1069583603dd1b9e4b0044fa4ddcdd31c7
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    memory/240-2227-0x0000000000400000-0x0000000000590000-memory.dmp
                                                    Download

                                                    memory/712-174-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/1128-241-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/1404-70-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/1828-260-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/1848-229-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/2300-443-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/2416-2209-0x0000000000400000-0x000000000058F000-memory.dmp
                                                    Download

                                                    memory/2416-17-0x0000000000400000-0x000000000058F000-memory.dmp
                                                    Download

                                                    memory/2556-97-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/2564-313-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/2836-159-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/3288-620-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/3648-115-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/3648-93-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/3696-322-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/3764-569-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/3768-219-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/3812-21-0x0000000000400000-0x0000000000590000-memory.dmp
                                                    Download

                                                    memory/3812-2215-0x0000000000400000-0x0000000000590000-memory.dmp
                                                    Download

                                                    memory/3900-84-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/4640-2203-0x0000000000400000-0x0000000000590000-memory.dmp
                                                    Download

                                                    memory/4640-7-0x0000000000400000-0x0000000000590000-memory.dmp
                                                    Download

                                                    memory/4648-272-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/4680-34-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/4680-35-0x0000000002330000-0x0000000002350000-memory.dmp
                                                    Download

                                                    memory/4680-1-0x0000000002330000-0x0000000002350000-memory.dmp
                                                    Download

                                                    memory/4680-0-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/4728-343-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/4756-186-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/4756-204-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/4776-141-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/5080-303-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/5220-251-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/5248-291-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/5636-52-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/5660-2385-0x0000000000400000-0x000000000058F000-memory.dmp
                                                    Download

                                                    memory/5704-24-0x0000000000400000-0x000000000058F000-memory.dmp
                                                    Download

                                                    memory/5704-2221-0x0000000000400000-0x000000000058F000-memory.dmp
                                                    Download

                                                    memory/5748-126-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/5764-185-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/5800-505-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download

                                                    memory/5920-282-0x0000000000400000-0x000000000059B000-memory.dmp
                                                    Download