Overview

overview

10

Static

static

3

2026-08-19...ck.exe

windows10-2004-x64

10

2026-08-19...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/08/2026, 04:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
  • Size 1.6MB
  • Sample260819-es89jsdm3v
  • SHA256 64fb120c8ba88a0f5b2ee8037fee1ab4cb57553aa246851d92dc2e268860320f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 64 IoCs
    defense_evasiontrojan
  • Renames multiple (133) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 8 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 10 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 64 IoCs
    execution
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1096
    • C:\Users\Admin\rIkQIgYU\VYcYoEcM.exe
      "C:\Users\Admin\rIkQIgYU\VYcYoEcM.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:5292
      • C:\ProgramData\nkcMoUMo\HkggwYQk.exe
        "C:\ProgramData\nkcMoUMo\HkggwYQk.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:4404
    • C:\ProgramData\nkcMoUMo\HkggwYQk.exe
      "C:\ProgramData\nkcMoUMo\HkggwYQk.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:5836
      • C:\Users\Admin\rIkQIgYU\VYcYoEcM.exe
        "C:\Users\Admin\rIkQIgYU\VYcYoEcM.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        PID:2056
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:6116
      • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5800
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:944
          • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3304
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4192
              • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3444
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:696
                  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:3232
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:4632
                      • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:4532
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:1988
                          • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:5864
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:4588
                              • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:4812
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:2780
                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                    17⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:2076
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:5072
                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                        19⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4384
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                          20⤵
                                          • Executes a command shell one-liner
                                          PID:912
                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                            21⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5980
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                              22⤵
                                              • Executes a command shell one-liner
                                              PID:5724
                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                23⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:2320
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  PID:2828
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                    25⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:2400
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                      26⤵
                                                        PID:548
                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                          27⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:3064
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                            28⤵
                                                            • Executes a command shell one-liner
                                                            PID:6128
                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                              29⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:1140
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                30⤵
                                                                • Executes a command shell one-liner
                                                                PID:4224
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                  31⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:5860
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                    32⤵
                                                                      PID:2496
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                        33⤵
                                                                          PID:5336
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                            34⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:5664
                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                              35⤵
                                                                                PID:4516
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                  36⤵
                                                                                  • Executes a command shell one-liner
                                                                                  PID:896
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                    37⤵
                                                                                      PID:1928
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                        38⤵
                                                                                          PID:3860
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                            39⤵
                                                                                              PID:5472
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                40⤵
                                                                                                • Executes a command shell one-liner
                                                                                                PID:2232
                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                  41⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:2224
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                    42⤵
                                                                                                      PID:2092
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                        43⤵
                                                                                                          PID:3108
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                            44⤵
                                                                                                            • Executes a command shell one-liner
                                                                                                            PID:4828
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                              45⤵
                                                                                                                PID:2112
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                  46⤵
                                                                                                                    PID:4304
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                      47⤵
                                                                                                                        PID:4104
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                          48⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:3580
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                            49⤵
                                                                                                                              PID:1124
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                50⤵
                                                                                                                                  PID:2856
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                    51⤵
                                                                                                                                      PID:4652
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                        52⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:3048
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                          53⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:5792
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                            54⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            PID:5552
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                              55⤵
                                                                                                                                                PID:1968
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                  56⤵
                                                                                                                                                    PID:2600
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                      57⤵
                                                                                                                                                        PID:1328
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                          58⤵
                                                                                                                                                            PID:5804
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                              59⤵
                                                                                                                                                                PID:5456
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                  60⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:4252
                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                    61⤵
                                                                                                                                                                      PID:3360
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                      61⤵
                                                                                                                                                                        PID:4808
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                          62⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:928
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                            63⤵
                                                                                                                                                                              PID:1856
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                64⤵
                                                                                                                                                                                  PID:5764
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                    65⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:716
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                      66⤵
                                                                                                                                                                                        PID:2256
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                          67⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:1540
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                            68⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:1676
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                              69⤵
                                                                                                                                                                                                PID:4500
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:4140
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                    71⤵
                                                                                                                                                                                                      PID:2312
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                        72⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        PID:3256
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                          73⤵
                                                                                                                                                                                                            PID:4684
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                              74⤵
                                                                                                                                                                                                                PID:2572
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                  75⤵
                                                                                                                                                                                                                    PID:4492
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                      76⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:5324
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                        77⤵
                                                                                                                                                                                                                          PID:3416
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                            78⤵
                                                                                                                                                                                                                              PID:3396
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                79⤵
                                                                                                                                                                                                                                  PID:1704
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                                    80⤵
                                                                                                                                                                                                                                      PID:2728
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                        81⤵
                                                                                                                                                                                                                                          PID:6112
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                              PID:3080
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                83⤵
                                                                                                                                                                                                                                                  PID:5660
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    PID:4324
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                      85⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:2740
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                                                        86⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        PID:1252
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                          87⤵
                                                                                                                                                                                                                                                            PID:3680
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                                                              88⤵
                                                                                                                                                                                                                                                                PID:2912
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                                                                                    PID:2668
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:2692
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                                                                                          PID:2892
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                                                                                              PID:5924
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                                                                                  PID:4744
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:2116
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                                                                                                        PID:404
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                                                                                            PID:1680
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                                                                                                                PID:5084
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  PID:5968
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                                                                                                      PID:720
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                                                                                                          PID:2364
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                                                                                                              PID:1224
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                PID:4512
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                                                                                                    PID:4864
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                                                                                                        PID:5200
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                                                                                                                            PID:5932
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:1796
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                                                                                                                  PID:3180
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                      PID:5564
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                                                                                                          PID:264
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:3292
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                                                                                                                                PID:1888
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:1948
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4316
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2448
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4916
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1460
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4560
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:2968
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                          119⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:3648
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4356
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4160
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4564
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:1172
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5988
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3172
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                      126⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4152
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3868
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5720
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2524
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4172
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1352
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5248
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2136
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3136
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4620
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5928
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                            129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5236
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QwgoMAgM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3360
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3864
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4312
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                            126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                            126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4508
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CGYAwggc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3904
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4888
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2020
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5580
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3136
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yoYswAIA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2664
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:260
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                    125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1364
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2524
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3792
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3596
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2868
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jWEIQYAo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2516
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3948
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5116
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2960
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HYwgQUgo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1476
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3136
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2584
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LkokkcYo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2928
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3628
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3208
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2524
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5360
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1172
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WycEIoEI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1428
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4272
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3352
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4344
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1696
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eiIkAkYU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5236
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3384
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3348
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eEIAQgwM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1784
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3092
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3568
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WyEoIcII.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2608
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4312
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4764
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3352
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rAAcMwIw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3516
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5332
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1476
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1284
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LmckgcIY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3868
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5580
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1424
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5856
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:988
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DgQQQMUU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3128
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1448
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5116
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:264
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UoMQswQI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3404
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5424
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:932
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3952
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qUEkEUwE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5616
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1424
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3508
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KWkYMEEs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1180
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3368
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4272
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\veEwUAwU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:484
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:480
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3592
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5840
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vSUIAMoM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5896
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:260
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1352
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3452
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3700
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2020
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\feMoIsww.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3212
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1136
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                              90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4764
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                              90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5588
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                              90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3352
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AEcUsEss.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                              90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1976
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1404
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                          88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3180
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                          88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3460
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1948
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uMwQgMMo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5872
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                          86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                          86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1360
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                          86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4704
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IkwcAAAw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3732
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3592
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                        84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1444
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2136
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                          84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1796
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                            85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1836
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bKogwwwY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                            84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4428
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3508
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                        82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5716
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                          82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3384
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pcgskAAA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3496
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1888
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                        80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1752
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                        80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZQEwAcsI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                        80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                            81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:988
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                      78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2040
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                      78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3868
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3948
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JmsQIEAs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2452
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1696
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2916
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4272
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yOogUwsk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2348
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1836
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2960
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3368
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:988
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EkoUUAAk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2160
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1352
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1696
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4704
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                PID:480
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UwsIYYIE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5668
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            70⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2516
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            70⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1976
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              70⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2452
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tSIYsEso.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4580
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            68⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1948
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            68⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              68⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dEccUEMs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              68⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1944
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                PID:932
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          66⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2160
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                          66⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1196
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3404
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\deYUEYcU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4728
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                              67⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3440
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3596
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NkQwUUYo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2304
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                            65⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1448
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                      62⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1352
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                      62⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      62⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4748
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cUsUMEYc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      62⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5348
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                          63⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3568
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                    PID:404
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      60⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5248
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                        61⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kMYIIwQQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                        60⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5796
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                          61⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                    58⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1540
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    58⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4152
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                    58⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3080
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SIcMgIQg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                    58⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                      59⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6060
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                56⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                PID:2604
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                56⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BCQgIgAs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4540
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                      57⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3292
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:3732
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                PID:1944
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                PID:3452
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lswsckQw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  55⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3864
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:6060
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:5308
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            PID:1408
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uEEUgoUA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:5056
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                              53⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                              PID:3952
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                        50⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                        PID:3080
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                        50⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                        PID:1796
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                        50⤵
                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                        PID:4152
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MIYgcMoA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                        50⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        PID:2800
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          51⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          PID:5564
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    PID:2976
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3508
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                      PID:2584
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ygIUMMsA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:2272
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          49⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          PID:3224
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    46⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    PID:4788
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    46⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:4760
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                    46⤵
                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:2304
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                      47⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1828
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JSgUMkcg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      PID:4544
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                        47⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                        PID:4968
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                  44⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                  PID:6136
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                  44⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:4512
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  44⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:2136
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                    45⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3592
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MmsokwgA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                    44⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1596
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                        45⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                        PID:2912
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                  42⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:4272
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                  42⤵
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:2524
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  42⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  PID:3096
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JQsEsgUs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                  42⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:1684
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                    43⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                    PID:4408
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              40⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:5564
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                              40⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5332
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                40⤵
                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                PID:3396
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IsUsoUYY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                40⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:1716
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                  41⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                  PID:5812
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                            38⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                            PID:4996
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                            38⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2792
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                              38⤵
                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                              PID:1764
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DigEocIE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                              38⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5760
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                  39⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:2584
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                            36⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                            PID:4164
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                            36⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                            PID:4316
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            36⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            PID:2040
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yMsQkYUU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            36⤵
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:4900
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                              37⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                              PID:2548
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                        34⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:1884
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                        34⤵
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:5896
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        34⤵
                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                        PID:5360
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EOIAMYss.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                        34⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:976
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                            35⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                            PID:5328
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                      32⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                      PID:5248
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                      32⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4300
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        32⤵
                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:3180
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YgQoEIEA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                        32⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4912
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                            33⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                            PID:4172
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                      30⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                      PID:5472
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                      30⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1856
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        30⤵
                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                        PID:3628
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jWksgUQY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                        30⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1088
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                            31⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:3332
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                      28⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:568
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                      28⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                      PID:1828
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                      28⤵
                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                      PID:3128
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pQMYgwEQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                      28⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:2108
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                        29⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                        PID:1676
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                  26⤵
                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                  PID:3792
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                  26⤵
                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                  PID:3440
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                  26⤵
                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                  PID:2520
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foMsMAYY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                  26⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:6052
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                      27⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4556
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                        27⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                        PID:2460
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                  24⤵
                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                  PID:3372
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                    25⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5340
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                    24⤵
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                    PID:5348
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                    24⤵
                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                    PID:1928
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sEEQwsQA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                    24⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:1896
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                      25⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:4956
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                22⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                PID:2908
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                22⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                PID:1540
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                22⤵
                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:1732
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uacUYcEg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                22⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1092
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                    23⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                    PID:2972
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                              PID:4328
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                              PID:3224
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                              PID:3212
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DWcwIwEs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:984
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                21⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                PID:4864
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                          18⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                          PID:932
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                          18⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                          PID:2468
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                          18⤵
                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                          PID:2312
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FeUIMwEM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                          18⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:4768
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                            19⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                            PID:2976
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:2792
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1828
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                        PID:1796
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zecIIQkE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                        PID:2804
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                          17⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:6104
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                    PID:5356
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1760
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                      PID:3724
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZQwkUkUs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                      PID:4488
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                        15⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                        PID:3368
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                  PID:5812
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                  PID:5340
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                  PID:5348
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kiskIcEI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                  PID:5344
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                    PID:4828
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                              PID:5308
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                              PID:5892
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                              PID:2908
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugkccYYc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                              PID:1608
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                PID:5600
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:1292
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                            PID:3360
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                            PID:3212
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cAUsEcMA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                            PID:4800
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                              PID:1444
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                        PID:2852
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                        PID:3592
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:932
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vCcccksY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                        PID:1916
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                          PID:2584
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                    PID:1796
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                      PID:4556
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                      PID:2804
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aUMskMgM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                      PID:3912
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:568
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                  PID:6052
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:6008
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                    PID:3108
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yggsgwcE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                    PID:4296
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                      PID:2960
                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\SswgAUsc\IeMEwgos.exe
                                                                                                                                                                                                                                                                                                                                  C:\ProgramData\SswgAUsc\IeMEwgos.exe
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                  PID:2352
                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\nkcMoUMo\HkggwYQk.exe
                                                                                                                                                                                                                                                                                                                                  C:\ProgramData\nkcMoUMo\HkggwYQk.exe
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                  PID:1812
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\rIkQIgYU\VYcYoEcM.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\rIkQIgYU\VYcYoEcM.exe"
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                    PID:2268
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\rIkQIgYU\VYcYoEcM.exe
                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\rIkQIgYU\VYcYoEcM.exe
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                  PID:5808

                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                      Reconnaissance

                                                                                                                                                                                                                                                                                                                                      Resource Development

                                                                                                                                                                                                                                                                                                                                      Initial Access

                                                                                                                                                                                                                                                                                                                                      Execution

                                                                                                                                                                                                                                                                                                                                      Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                      T1059

                                                                                                                                                                                                                                                                                                                                      Visual Basic

                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                      T1059.005

                                                                                                                                                                                                                                                                                                                                      Windows Command Shell

                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                      T1059.003

                                                                                                                                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                                                                                                                                                      Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                      T1548

                                                                                                                                                                                                                                                                                                                                      Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                      T1548.002

                                                                                                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                                                                                                                                      Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                      T1548

                                                                                                                                                                                                                                                                                                                                      Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                      T1548.002

                                                                                                                                                                                                                                                                                                                                      Hide Artifacts

                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                      T1564

                                                                                                                                                                                                                                                                                                                                      Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                      T1564.001

                                                                                                                                                                                                                                                                                                                                      Impair Defenses

                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                      T1562

                                                                                                                                                                                                                                                                                                                                      Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                      T1562.001

                                                                                                                                                                                                                                                                                                                                      Modify Registry

                                                                                                                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                                                                                                                      T1112

                                                                                                                                                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                                                                                                                                                      Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                      T1555

                                                                                                                                                                                                                                                                                                                                      Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                      T1555.003

                                                                                                                                                                                                                                                                                                                                      Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                      T1552

                                                                                                                                                                                                                                                                                                                                      Credentials In Files

                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                      T1552.001

                                                                                                                                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                                                                                                                                      System Location Discovery

                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                      T1614

                                                                                                                                                                                                                                                                                                                                      System Language Discovery

                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                      T1614.001

                                                                                                                                                                                                                                                                                                                                      Lateral Movement

                                                                                                                                                                                                                                                                                                                                      Collection

                                                                                                                                                                                                                                                                                                                                      Data from Local System

                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                      T1005

                                                                                                                                                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                                                                                                                                                      Exfiltration

                                                                                                                                                                                                                                                                                                                                      Impact

                                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                                                      IeMEwgos.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\SswgAUsc\IeMEwgos.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 66df636997e27e8346f5cb90374c6185079e6f5e574fa2723af93d447fc68c57
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 edc20768d35daf192e5d4e04866333d78ad4aafdd6e341792ec3048a757ba0c2
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 b06cf32e4df1007e226ee304b75969a6c044a659d067af2f8a0f84570442caf6
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 0044d593a2dd7f79f71873ee6bfd065c234a12dacef504f0230e9718de6a6dc6
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 35be2c8db2ab7ecd4dfaea0d1d78d8504df737115cb24cf83d03c8f317f372ad
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 2d8494b97cc756eb90326401110a09f17ef23355dee15cc2d67d253ac813c6ae
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 e0987c731df27ced914f47c986f4c420409264c83b968878bf6fa615e32d975b
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 009721cfc6c5fb7f218a4c9c136b70920f7ab3990d43f7278e00ee25d3ff6ba6
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 f661dbbb40784bff2064d10a89ece2ab57994391873434b5f582ecc95b11f725
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 06a06433df3613fbe4fff361eb7e2840b4202b79de3d9194a33b137d91a09370
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 910a7a5416d1043f19741d33c57d8df265d055010236c382a7856b3c457e593b
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 ccafa0afdc762fc1a505b35021f3fab67d66d72c7582f97111caea2b25b2c674
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 9ef135e0c647e423ff0d45e0fa1942178441340018bafa454ee14a4dcfffbbed
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 bf39eff42dead719bb4b56c9e03b1d74b07ce94ceb3b4fa5f89fc6069721dc69
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 1a725dfcb7aeb07f2b78a4acf910eb66180a2b42cefd49c4fd7293fc25fcd0bb
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 cc5fd9c45b8f56e81896f4615638a110047550fd1f6fbd0bd703470e8e538946
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 f1beeb08f293957170f2ce574702426d80af776b60cccee83dd76c674b2b0f27
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 378aa4c32d228607d3d477ed24410ca04439f852d24a21e2f439c3d24e45995e
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 1cfb60284e5847832dcfd0dee6e9da2d8541822756d63ddb371a7835803bcab4
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 87eb8cc5f1ff07c3f5caa37b79c71d7c321aa301219948de4539e9738816a8bd
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 fc71139281d6b592ee75a398911a5be3c17d95eca4ff5b66d1a54c20ce534cc9
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 f596987e7f4955d4596a5612a592f0939eea85a0ae41a783f4e082e707db08ab
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 4fcf9718741534fd1c521d22fe8d7a1cb0be416cc90f1977e973ca68636d94ce
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 031ff81ec0759723035a2262b0e5f7703edea733cb362ed6d27320158c515222
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 4fc425a73244525a0c898ede532f98ffc35930069fd83734cd625228d03eb639
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 035eb229b91552b1a276ad976a8c65e20d8315ade7018d19adf6e270cf3fc3e3
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 84296ac6abbf62cf8198ab6330f787127c2981f601e37eec8799d60c14a60370
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 7b0fc6c4825b09032a011a372306c59629ef08d6d3d9838b4ef0c75ea47e9b6f
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 31cd7f9eadaaf20e6c0f7159a8a0b3eb39fad57875ddfa65539e5065152164e2
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 c0fdb034a68f50fa43e847406c3c7bc48567bfe72f43b8aca48661843012c8e5
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 5e9f98dff248db9aa4250b921f313bb338382d873890f87be85b6bf5827bbf14
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 e9fc496a3c4aabbc866c56f578959db9fc46223fedc25aca68ccf92d1a51d2b9
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 9027d44f3986aeeb8cc8fb0688891a6231935f711b0e6cb36895afe7a3877b12
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 59975a6bbc0b1cbb9f08073cddda9084188eb5c0f5f8d05fec32a9fc83f55a52
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 8df19710675893d16590c5981b703625b91e300c2b2701356dd75408be7b7fe4
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 ffc4f8a8e130c42fd2777a9240b89b5de75ea99a0566128e44ebcd5150ef1aff
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 19c6d009f66cb750574dbc5b7ab8e7c3ad2a09fd834e99699067de79ba22e623
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 611c21b6c42fac3cf2476794e16ee23eb77cf34ef830a33c24a9b9457f9c1404
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 85392f4defaae1590c70424ce62b0b0d6bfa4fbd424bee3a5cc27463f7e977b9
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 ff9dbbc7ab969e632adaeb1840256c43bd624cdae5f3038169a6065ab2fbdeee
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 588aec562b69940d75b755e4bba16a9ef2ca0415ac11b165f93bbf2a264e4ccb
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 2651a8e5558117ac30325bf6e1d9fbfc1207c44e0261ce343b0df4447955a7e0
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 16d4c1f89d4093e38d0f74c6a8c4d1dc33df564e04c0f7f0f597b73288535ac7
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 cf2ce39c086c836bdb9bd01ca9004411f0c7e6fc26667d9e7e2541530713ffa5
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 221df302bf95f55f0e35c0b5f3a307f5ee408e0996105fd3c750b1a335e10afc
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 df3a4cd6ce3301d4f11d00f5116b257cb95f49ee25aa66f19a0c390c71d1ffa3
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nkcMoUMo\HkggwYQk.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 4b23853a8215ba949b0f2041c31966885d59cec28ce8b4725459c9ae3bc225bf
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      qEUA.txt
                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\qEUA.txt
                                                                                                                                                                                                                                                                                                                                      • Size 9KB
                                                                                                                                                                                                                                                                                                                                      • SHA256 cdba811bb5ef7f92177cccf22e3f2ce57adc052d1371d7eb49a60c20815e0964
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-08-19_d622118d542841bf6286f31f34d23010_elex_virlock
                                                                                                                                                                                                                                                                                                                                      • Size 38KB
                                                                                                                                                                                                                                                                                                                                      • SHA256 0f35ace5268db33940ed18e946a9c65be4e31ec0ae31faa6e60122859c5cb5ca
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      file.vbs
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                                                                                                                                                                                                                                                                      • Size 19B
                                                                                                                                                                                                                                                                                                                                      • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      yggsgwcE.bat
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\yggsgwcE.bat
                                                                                                                                                                                                                                                                                                                                      • Size 112B
                                                                                                                                                                                                                                                                                                                                      • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 b4fde8e4cdb6785117ac84789d2388feaa9c5baf03d50d4d09dfedacde6a0a7f
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 09f2f73e139807a808c3191aad49626501b2e40b195ab4a05176eaaa30b6d86f
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 8f8183a71ec012c4d66eaa8a543af02226943ce159c3604a6753427b16a45c56
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 d462680eaf4121d15a9d6711900828ee71654a6ad3bbe0deb109094d4c16f0e0
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 8899ca3140441faf608e97ed9c492ec4f3838ae39de44c73675586dc9e5f47af
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 bb2d96ff9ceab863e36bb63d3c557220414e2bc7a62c8c8e94e3fead65093f4f
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 ef62728178addd621a3f5527bf2d13162bbed5300e8eaef3b3c1cebf648878f7
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 36afb089167f26d80879a55b5c21169348896ece49e7f2003074904dbc44bbc5
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 79fcf78ae81b5769ff9d61632a55b0be49f3c94a2e220f62cf5feee53ee17c83
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 53a23c5bdb0b89b9056da80d6e2e2c9fd406d8a1cec08d42bc84030fffd4e1c5
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 cabad0798ffa4f06e25e3e73536459e910a28c7c1d2a7eadde4a0f3bd1a44272
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 33ccbba681fb7d732339f881c1f6470ad8bfb837af2aa92dabd43418fa4f8da7
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 7d6cb4cfa89168348f15f071ce96c1e99cd0ddc43ed78b2f20b12a5e03be36f4
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 718b80f62cffa68839f0b74f76e09dbd2ddd5d324421feda7342133f8f444b62
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 2e1341b29c345e6c7bb77ae96acc392eec6054bf5b7e510f51315cd89594b7d6
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 3ec7f998f0132818cc42da4400eeba89b106903d247c1542fc05f3398c870aac
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 73d6c375515578174afcd0335c1dd7f4c3bb0b22df43f230b983d25ad87790d2
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 3025eb47d32aa8cc42ad0d98b6297346fdd6e9e3bfb2fc85060be11eb5500680
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 c82e85e4444fab52356ef8d14761dcd6e003db294623eb5effb533c49cb448cf
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 2e3e7e76e3f0481bca4e43ff2546dfcb6e5dc7581f4f0d594eeadc5176736940
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 92a4026b516921c78087b8993ef990ae1bb63a09c654cf2297f257872e20dda5
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 d5dd61bc8ebbcabfbee6b0df6a710ab35d25c30ccd26b4c3d6ceb66eb298509c
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 2ade8e26d95546baf754f8f9664769aa74f9af69dbe3a5392ae4ab2d59e189d6
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 47a3ae15c733091584829f533b6cad9d2c09adb0f9d857ed79a92bb80b12386d
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 6df68b8f333216ba50c4427fbf289e21a3cb813e3f443bbd881cb262c09996b2
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 daa3ca9b179f288eb3a3837b4f15cfc60625d03cb708b61294f7d9f3b9efa1e0
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 5d69606252d2ccec0e8c4bb9f70ba702cd38eff41ce4982a236ec16502c0646a
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 4b32acc88e9dc2a92a84d4d4dbf1fc6c849235d7553d7db57d5da7d2511d083f
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 a4d2adcb3f9ba5ac00435e2714b0714877aa0fa5873b32e3d75afca0c55f477a
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 fdff2f26a84978d9b891d55c9c2a8c1b591ceb526f60bd4e8afe152fc57ad2c4
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 7897e36078ae2b9549db1f560269d7dbbc0a5c85ee2d4888f4ccebb5ce53232d
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 0463d07667251e20957c4e69071028226fd3399a5cca3c8ae05f652332aaf614
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 0a92058833eae1b8f58b2935897f63c94cfd3796e921ae0d093c08879850fc6c
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 5ba2c75c0bafc0d8c6518c41fe72792b0e1aa9d2623ef0646f14e68a534693dc
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 daac414058f22f55df48eabd466ef8dab1c1463856370f675c75e67be29c6c4a
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 4061a4ef7c91ca4f6a295f1ef35603c45f777b33a6dcad17337e8dbbe073ac79
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 910a28d3296f03d75587f78c307b551cd41d4b52caaf669cf4f0fc533c886891
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 a9090f1a3bef38187226681ac0b78c9ae7fc9b01211c161fbd7219aa4e8c6f48
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 b3073e89ff33396ec3e09c39124405977c5557a8712779ced94204014fe5f7bb
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 107879fa948404b6b78b3d31017a3cf705bb59f8ccfca5fd336f6fadfe96b819
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 6eb78a669a00cce6f7ca9e71e8974a4248b4fcd23db9d6484e6bcc374bb61c84
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 694b6defc7032f19202925eea20be11f89dfc3b06659602fc141e99a1b80c7d0
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 cd05785b0135ae59fcfb3e474536cd92f4c655ec3a002b88a320a734160c3bb0
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 005b5a7c4c1b26ac470ec16406d022c3eec55bcc60fa4f7d754c01016d4d13be
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 85bca2d5abc85fff745aae78b6b921e1033b7f7cc4c26a6aec5fe21569adc068
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 0147bdf65866c49f0c16d0d9c7756c2c66635e6a12d6627decfe68092e805311
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 a568024a8bf21d1de902abcf8c8d3255de168ed4568f983fa286fd852b2af7a0
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 083969bce3691d86ce8045c1b5aba6207e5b9fdc616208714022506f29686f5b
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 d353ad9fe3526b5a065a56d0e6188b3119fffe142542086694e1efc5846001e1
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 666cea90f3163ba1b13814ef8c318f34c774ba8cb6005706a45fe28e02412c73
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 81256522bc05c56cf1dd7a0286a99150d94db4a4e6609547abc01b753ba00fc0
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 cc58ace8f0dd38089784b1d5a385d8a3ebde48eb9c8de6f59c9244a5e3881cf0
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 0bdc99af588e2ddd3d9852ff28a81d8cc1074cb5a72fe184b90b5290fd4e8753
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 7b49601223d81f200b4c1c7e1ef28e037ce5a22e3c290726ea88d3e4aa689d9a
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 a32ed8009584b5076ae26b1ec155b7950a62c3f5af58a4751cddda8de3211917
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 82cb39ce338c64d5cddca6dbbd1d43e9479a805f255b8d81c18eaef7b04a2a0a
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 902a640b6bd0559894be6e65b49f2329d4eb81d526f424dfe97dc24a6e48802f
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 1d3348f520d267d38b0dfcd636046390b3a84c09ce338454200670dbbbbc1ca7
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 5299584004e375202a670a3adca6875e0c91d7685db6d0c0de51d63497ea7b27
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 f45cecf9c3a103eb75bc76bbcc8dc31f87e80135c9ac83466b6c5a201e34d736
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 c267918966f6b96b7aeae46f6d2e6d02707d8e0c093b55aa688fa3b862151bee
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 d4eba2398ec897157d978e8497ddc20503e533381ed739cdb1d7dc8a1c3dccb5
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 0cb9f15baccd95354280596a1f41cb121852ea334e7b0939ce02026ee519b5a5
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 46f7664d9015e8ca58048d670002a3f8f8025cece1b2ae185a333a66d48cee01
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 061c1e86a388511e541152d59774e8c7481f3c91c662ca7520f6371921d75d7a
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 1cfb05178800261651bc4cf96502c545eed0dc2e6978965aaa734182eb69fd36
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 3bdc3b5c5158057ab507bbbbbe5ece9b684fa1ddaadb633719bce60af18001fc
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 b145320da46a01e71a57221ebca1532e6228ae084455439fe3b72d84c19d9201
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 fca7632f72da6a5158f1680be0eef84890ba400f97b60bc5ad601284a0651860
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 9086912645a4405007eb2fcfecc191dba919dfb699aa798240287142ff457189
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 5014151208c782dc5c5130d16d1a28e74bc82b7a053710899573084f88ed5b1c
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 10e179132a77dae02e2373c1bb223961e6d5d6b23c34c0a95a24d57f67b29f28
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 260dd35f4af6e765710554ad1371bef4ed7364c89567cbde551c90d48fbb10ef
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 49b89f4085d4a72aa413dbb5934948a481e2a00ff3187da69ad9dcbd79199f9e
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 08d556c9cecf6d3c04a99236bcab04c271f30ff1e3130acf268b5ff3729e59e5
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 6cd754743a313b1a6014ff79e4eec3928874148066c8d84fd3660af02d348bcd
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 b64db17baa5180d2ff1b07c844ece488ab3377a94c1f49a853b29851e426bfad
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\rIkQIgYU\VYcYoEcM.inf
                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                      • SHA256 af1aa125b3b41abe9557d2d6f51a31356475c4390f0b376920cf94f0bd479e3c
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      AMEs.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\AMEs.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 d24ed83fbc5be9bc557bdb444b0b0259ea187eb5f0e1209b830a80ce56b23b71
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      AQom.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\AQom.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 4d32d4099528513804819fab22c16b365645cf5030034bebb1ad68ab7c2446b5
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      AUUO.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\AUUO.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 47d71567016e8fcc1eb55690706df0a83fd491ac75c1d0c2271b275cddc1347b
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      AUky.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\AUky.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 f115008dd01d4deea051fea3ef3c008da866b2ab2c80dabeecfad353ece8cc6a
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      AWQs.ico
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\AWQs.ico
                                                                                                                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                                                                                                                      • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      AcAE.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\AcAE.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 ffbbdd07636b3a28197b059c21c615b5e2b5493e8767aaf76348f209c415f6d2
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      AgQs.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\AgQs.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 a24414df240eaca2f8921951de9f8feb06ba3809587d8047ed392bfd2bb00fd2
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      AkIc.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\AkIc.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 3c534d93b8f3a4745aa30da53ef97ffefec1ec1ac8ec98c00bf23cdc8b45e032
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      CIgQ.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\CIgQ.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 43964f9707c461398d352a401c953cd32a59f8822b261c8e7fada46f1c366863
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      CIsY.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\CIsY.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 de3c4cff98b026a9b94815d1136b8891b6eea3a87008ab83ff157bd136bb66de
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      CYYu.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\CYYu.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 f008d172a3d6e49f7ed35ee48cbfc1fa9ff7f81d68213a07b10a2d19e65698cc
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      CYoc.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\CYoc.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 90438b6d35fc4c3352621d1b51954bb5d60d4b4e36baf734118711fbb205016f
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      CgQU.ico
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\CgQU.ico
                                                                                                                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                                                                                                                      • SHA256 9a233711400b52fc399d16bb7e3937772c44d7841a24a685467e19dfa57769d5
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      CoYi.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\CoYi.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 514ff226e6b0f684ef11b41654e3e9719c6b3c3f22ef76aef6ff2174a2642bf0
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      CqEs.ico
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\CqEs.ico
                                                                                                                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                                                                                                                      • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      CsAw.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\CsAw.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 3fcd65dd09477184680d885a7dc2b79da1c6d5dc39b914de50c2693863154f26
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      EIsC.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\EIsC.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 9c8e5b505a722e6e865a380f487e5b44bdcb3e7a6916ce8443fcaffcfb9a8295
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      EQcS.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\EQcS.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 9b7abebfd1d24cc8cd4a5722756af0098e0260b2485187ea71930c4ced987b98
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      EUoC.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\EUoC.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 c5193b28da64b6a330c8d69e0eae543ff16b73cf15c6a04e1a3d15683dcf5e88
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      EYIs.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\EYIs.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 560eed66bcd79f370f516026fab5e8480fc390b3bb8cea496dd854196c3141b7
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      EcEw.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\EcEw.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 b0790c0335959b05af60e8c409ae6bbe8eb6a228f9d9b503ace29f667d334491
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      EgAM.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\EgAM.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 dce4aeb72423cf817184b685e166cbc9ade593617c845b7447566478646eb259
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      EsUa.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\EsUa.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 dabd3dfbb4f4083766e2df2ea22ea731ce2f4fa39fb9b88fc81f708a0c87e7fd
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      GQck.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\GQck.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 559d3887a83404283d72dbeb344997a52bea6f8a461a71ab1bdb51f6f9dcfee2
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      GQwg.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\GQwg.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 f3e40d1c164a2f7222710d0dc3a8652eaa66dd5749a68735f4ea9fe8311b50c1
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      GcUa.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\GcUa.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 6f01f6495d775f1c95047801a484e6fd5d0a0682c29a50b322095b155ee9e945
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      GoMy.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\GoMy.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 46d5a418e7414e0b41ee14fc33e28175f722529cdc5fbf763e1d88d18721cfea
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      GwEi.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\GwEi.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 422bfbc6bbb568f72b69e5cd7474520d7b7d9608238a8a7b03454d5899f44fb3
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      IQkU.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\IQkU.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 b2a0d8dd83af25ebd85b0401f257dfc3ca6b6a3f7f19e21330adbd33e9bb19f6
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      IUYe.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\IUYe.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 2962358a2b780637f8e6b5b86b8fe497091eb1a48e1b7cc4a9e87a057b31463e
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      IUkm.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\IUkm.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 24afed7c0f417e4b940da81c9ce0204914892c92971ec4fe7a7d7a764a262ce1
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      IcsA.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\IcsA.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 655e0c514fc1edc6b196348c587122967b9b8a71d3671f329c42e095b750c242
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      IkoE.ico
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\IkoE.ico
                                                                                                                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                                                                                                                      • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      Iwcs.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\Iwcs.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 4f0c6909d36545610d4de772ff85bda8809f7cee1253a3c7763c8ae5b4a0163a
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      KYcg.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\KYcg.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 2089ff1d6a5dbbe4b3b463e77cb1f89721c61a0b48704a37f9d9364c43f0da32
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      KcYI.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\KcYI.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 52f00b840a15a907edd2746727aeecdafb623e655eb468a2bc46a91405543b62
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      Kcgu.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\Kcgu.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 1bc6a94b30c15353a310791fb389ed32331307d56c64311917074d7731583a8e
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      Kkkm.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\Kkkm.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 b084a2ef18ccfc9a1a90d53ce9cfcde43dab684414ca4657a7e83a17680f4627
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      KoQI.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\KoQI.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 fb10b63f5ce768667335d42197a9cc0c6252e929e903ef6876bad2cdf89d760b
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      KsYw.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\KsYw.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.5MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 6dcaf0e181f70bb831e305871dba4c54a22c4bcd5f5df86ed43f206e66bcd468
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      MUUI.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\MUUI.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 07e3cce80874b53032a06c757d22c8ebff506945073a394c9746c8803697eaf2
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      MYsM.ico
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\MYsM.ico
                                                                                                                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                                                                                                                      • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      MoQA.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\MoQA.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 e58a3998eba0eefa2e9efd442fabcff044b397370bac1546a3158d643c7121cb
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      MoUK.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\MoUK.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 ef76d4594e19f9136039e3a4eb250adacae3018a69eb8e7189230619822bfb32
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      OAEQ.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\OAEQ.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 3e77a53657480402461463a1b406a7292a2a328a064779ce4bcd36ea22946118
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      OMIe.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\OMIe.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 d11db7778772b5dd44f8beec0434b2aad2d1345def0c6e508d53e9a6fdabd092
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      OUAs.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\OUAs.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 4ccac52fd93f4891fcc7bcc2117a133d54a34b537ba28b9ae4ac6fc6db45f74b
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      OUIs.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\OUIs.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 7d6a7265f30aad2e896887da10bf0a628b3aa530e3169d5fbaa44ea59d4f275c
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      OYEy.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\OYEy.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 660c50c22e4e31f37de419200987e581855b15baa85b66732b3638214ce86f44
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      OsQS.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\OsQS.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 8b2cee1b268492ed7baa7a3012bbc853ae5ffe5305fd5b84c1195cffd875d773
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      QAIA.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\QAIA.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 47211082aa4db1cc2193a7a256e04b169467b3227dcd2e5ab73fe1d6e4b74f66
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      QQoI.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\QQoI.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 de863ce707235bf7edc5a0bf05944f24705d691782e39b897f72eb80303d7ffb
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      QcIC.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\QcIC.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 4e98cf5c0f05b0567b4b6a020f7cafafc577989ca3ea76c27a6c69bf197d9b0c
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      Qgsg.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\Qgsg.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 b2c041ff66e8d15f22b3fa7d163dc0291aa69cfbe9e5dd40b250db05a3eb8779
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      QkAK.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\QkAK.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 ab2b3707f7eddd5df2048f46c0b8c54c8a952a1bbd446f7cb3be0613bc658fb8
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      QkAo.ico
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\QkAo.ico
                                                                                                                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                                                                                                                      • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      QkIk.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\QkIk.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 4374acfdeb9d98acb8e0898c9827f465de33e31c1778fd7f5a8faea26e6cf92c
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      QoIK.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\QoIK.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 a8e512938c4a91005d58d22c43292b8e21e43194d890aecadf8e4076b21555ef
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      SAUu.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\SAUu.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 92cf6292581a26ecf4bcc1a4f4dfd4e366ca6b6cd6477b9361bbe1149d3d59e8
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      SEcc.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\SEcc.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 cbbdce3eec9dd69e24f597c2c9de3581a5d62846d3bde12fb5e42d7b03ae33cb
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      SIku.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\SIku.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 e5f4796991fd77080e8f2ab9807aa296fd593bd9a9d1f400194d227df243de80
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      SMoE.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\SMoE.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 3dcba0d0a79cf0fcf27eedba2a9913425988bfcb48275d12da4ab9424475ff4f
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      SOMI.ico
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\SOMI.ico
                                                                                                                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                                                                                                                      • SHA256 e1131246c60ad423586203bb8b9287e365051101ddbf532132bd47ef03ab86c8
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      SckS.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\SckS.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 cc84327fa11c98c328aa695ac1ef65027bb6218d184962d7a1c4d10c96a0c5b1
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      SgEg.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\SgEg.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 2257c7ecf10dce65f9789a0956593c7eb0c5b997c384f224d4a65f6c97ec941c
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      SgwO.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\SgwO.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 8fa6c21f1c07dd6a9b2fa7d5134317fedd0cbef9c2ca9510a701047b29043e14
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      SwMs.ico
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\SwMs.ico
                                                                                                                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                                                                                                                      • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      UIYI.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\UIYI.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 62cd57898d488a42aa2b18603a2108dbc071e7c463aedaefcf54c4d4524c641d
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      UIsk.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\UIsk.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 733adada4e51283b5094353cff9ba26759bf660e7bed4ff8370e88b0085552d3
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      UUwm.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\UUwm.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 ae0e1839d3f338d8aafb819623684959195207279212472c0b5ec074a3495621
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      UYsg.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\UYsg.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 0e85c05c6bb513ace02d697e7e4533507ac9e5ff74b075e283973eb0118b92d7
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      UcAm.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\UcAm.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 0eb62903e8edd43c0734763e7155120b56f68c19c3a79747b702a212111ac22b
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      UgwS.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\UgwS.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 4a4121b0e1121d44aee6fecb536e838aa76acda07640bc7fc38da9861c9b4833
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      Ugws.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\Ugws.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 4bdaf51ce58b3e7bed5b6dd9bdeb0f4e514242115967639ca6d1eb70733945ba
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      UoEm.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\UoEm.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 e255561c247964a2b09589e9be46d3968c4891f9cc3ffd1030b6e64df6b4e663
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      WAEI.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\WAEI.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 c2ad91e67059b63e0caa1a5953ffd65701e17cd0cce73fe3212f1238793d811e
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      WEEk.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\WEEk.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 1a372c708c75931947f1b130f7abbbb8d59ed13b36c9db9bd8ef392e02ae10da
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      WMsi.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\WMsi.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 812dc5f5c98c827d43e2b817e5be56ef1b9719c3430ddcc3eae7d4efc82bb41d
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      WQAm.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\WQAm.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 f54939f3fb7944c26e58d2d8eedee5aede3f1ad5c9de4b45954cb4556919efd1
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      WQIC.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\WQIC.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 a85ff62d82f86bdfd6c5163b2b206d37187c979e5443c235d79bc32323c470cf
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      WUQw.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\WUQw.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 d5f536f41ff0485e9defaedd5ad705d20246fd9c3db287aae04578e8b572f5ff
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      WYsS.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\WYsS.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 9c2dd631b84fc99ccfc750d81da2d018164783233d2d073a0dbd715e64d2b149
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      WgEc.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\WgEc.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 f7e3369f6d04df0c14d25a1ea1673a8b81179d4a11aa052fb8d262a22bc35858
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      Wgok.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\Wgok.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 9e01e46eb30fc832354b8924d7ff307aa40c26741e4a479826faf7c5ac06619a
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      WocM.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\WocM.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 372cc866401fde7033aee47a4f7b83098a4d2e2b1a0b2dcfd6fc179544198b1e
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      YQMu.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\YQMu.exe
                                                                                                                                                                                                                                                                                                                                      • Size 3.1MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 5859b3dd654442bd939ec15f7899a4f5f65cb56656db37bd78587a8f0f68da38
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      YYUi.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\YYUi.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 5fca22fd2e3c18df7272dd193f0bafd78e7de56ffdcbd41a75fcfa5095ccf321
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      Yowk.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\Yowk.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 df904a9f8d20d9e56e1291a908471f5ad591a9059ac1778ef8d7c196ca2690ea
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      aAgc.ico
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\aAgc.ico
                                                                                                                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                                                                                                                      • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      aEsW.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\aEsW.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 a3854fbe37c5260ea08a070146e138c82359b194591102b96d3f0ef42907a4d4
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      aIoM.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\aIoM.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 a4c1cfa6aecfa0704440d2c42769af5668acbd3c72f0fd55e506f81ab9343572
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      agIy.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\agIy.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 dbba913a556b7a6b7205410c5c47a07a34d85f399fa1bca12a1c3891a1f631f1
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      agMK.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\agMK.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 cbd632ad07e1d8d5aa5ab2e5d2960c6475104c915342aa41005037e440dc8bbb
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      ascY.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\ascY.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 7be21921a138eeee7837e78d03d2ee0d210dde4d35a3613064298fc521da19fd
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      ckkk.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\ckkk.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 8f68c668b9e54a97e37dc482d966aca9b1958be7a25eb8311ca2cf2551e379a3
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      cwIq.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\cwIq.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 f60cb58580a7521711eac62cb0fee8d49045c13dc1e33bf8cdff1c1e157abaad
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      eMce.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\eMce.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 f8abb41f67cded6aa377e3e392a9f07f9b977865f456adf62bcce0065f3ff921
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      ekAQ.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\ekAQ.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 c60e2a9003c44ff60e80037c282318692d73446d7831458d18036487b8d2adf2
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      ewEc.ico
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\ewEc.ico
                                                                                                                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                                                                                                                      • SHA256 5963420fd9ba8c8248e3f50d179dfa21caca8538ad1482a03f260b27cf218043
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      gQME.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\gQME.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 8049d34eb484ffb0d154351b26fb488d03ba44d3847bcdded4cb718ed2a07f3b
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      gYkQ.ico
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\gYkQ.ico
                                                                                                                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                                                                                                                      • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      gcom.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\gcom.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 0299710319799f2f9c8ef26dcf6a6e12f1101a18460fb943ac18ead55d320f32
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      gcsq.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\gcsq.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 0325a7938ff5eac822f03ae775169b5a265b0423057bdfcff079f974c0b5c1ae
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      ggYA.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\ggYA.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 599f921d725d0c8459ff51e64721a4b48e238641364ed884b48b01178ddca909
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      gsAA.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\gsAA.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 38ab332c5ee10b919a9e4de89a380884d3e047aed679042560bbec8d424fecba
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      iEUO.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\iEUO.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 22b0059c0d7b89d655a09fdc8fa0f85a8a3248e24299b6a93842641982c36a16
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      iIsm.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\iIsm.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 c08eb17bba647055ecbf9fdb95b3ef9e3b80b6678c49028a31b0eb2625b802de
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      iMgO.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\iMgO.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 6a4864ebb2cc5627bfc7765a2731ec93551d655ed1272584ccc67dc6ee585aa0
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      iMwM.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\iMwM.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 b9e9264b76583ab979605c54fa50bcde4ae798b6cdef6f679df0595784cbe6f1
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      iYEg.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\iYEg.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 7ed487eab93403d67f1e619153e2c75472c83908fd12086470340e8f4102e01a
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      iYgo.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\iYgo.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 46462e3e793c402a30e3e6ad1ba90bab3d236637b24abfb518a8f81c78f7d583
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      igkq.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\igkq.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 1ff3604f52d6ca60ca4e73d9f8379088ec809f1e55e46d4f9237b01e41025b68
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      ikky.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\ikky.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 54f23e26ff4735222e8ff69a960e6ef228aa9f011bfe8e4457980e935f4effe9
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      ioIy.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\ioIy.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 a624c0f2dd6d52a8a76ae2d45356cb810b8eaf5b7371cb38d6b3db7cfdc8903a
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      iwsA.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\iwsA.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 ca6d8003630fcbd688cc07d347e381d7647740f0bb9bf073a4e088c5ebf37e38
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      kIIK.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\kIIK.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 24ca281c4174261bf615820b6181114a7ade73d94aa409f1c75eee333a747fee
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      kcQW.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\kcQW.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.5MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 f3f1c97f055181d3add5389319971248083a7117678e0d1352f0395ba7aacf24
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      kccA.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\kccA.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 155ffa7dd1666e2542d40c1443bb8641bda2a8b06189bac6b3426c74de983e60
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      kccC.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\kccC.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 ad7d5e9b70e9af096712b7984bf26d9686739c941d564bc0965f78b122228c18
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      kgsi.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\kgsi.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 54c857a900c15e968dc5f304c3e061c7ac9db7a35b307fdea7c30733ef17b101
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      kogU.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\kogU.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 2b3580a4e96d6f29ec72ae214b151b60f8b76f4d30725e28df2279193d5ee375
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      mQso.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\mQso.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 14ee51a17e7f904ff4a1ea5b704d9cb1fc150ce54bc5a1d3049743ff7f6a3dce
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      mQwI.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\mQwI.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 bf1242d4252c3123c1107436a99385534ae05ed354239358a3c8a85103e452c2
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      mYgq.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\mYgq.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 869e6e61d300aee833502c36251a98057d0fee8f4feb69de73ce0660fd8cb7d5
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      moMu.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\moMu.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 84b1f47576d5f3611e769e67bcf3387177ed7d0e9c7e23bd2c8427f9e226eb50
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      mwII.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\mwII.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 4eb4b3c87b5a215ea7b18b7237808185318acc1ab6cb6d1daf7e228df9953e97
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      mwgg.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\mwgg.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 f01e25b050455009a8a8e2c7940ee5387a267983ad2bee12b56999eb8cb3e201
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      oAAy.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\oAAy.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 4399ce6cff68e6de4408c686183b728a215b35376ac62f7651789ba13c45ac6d
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      oAYI.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\oAYI.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 34e205713547a72d3cf19b35387f01602b1826f0ab0ca0485be884936ba9630f
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      oQUG.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\oQUG.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 bd169d71d307e8a8254563b91de5654038bf2c825c3d3341748040acff4bfc70
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      ocYa.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\ocYa.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 23467b1f2366cf5febcb961d66296e165a0c2e2ecfe6e6d3bf9fdd526ed7ccc3
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      osYG.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\osYG.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 7654eac23659488f6fc85f4cf4745ffc5d450fba4cb7894417672f6cf62341a6
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      qYQE.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\qYQE.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 7067735681babf6bf09a3faebd555f81fefbfbd86c48fc291273a1a108974428
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      qcMe.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\qcMe.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 c3dd9958a4dae9c324c5d1b3c02dfea99dd5bccc5114c143d64d85c8255dcbef
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      qwso.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\qwso.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 e55967b7b8df35c735abcec196099b63681c3b3b3a06c65fb418602cb5f8cc16
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      sEAO.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\sEAO.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 1ae78fba6f9c5ec7ce7e43445f02b0efc8f771f9a3ff79acae0a46a8ae12d0ed
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      sQcq.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\sQcq.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 abb8d13a73bb17a91392a595d9a0655962f9587b4de5b06fb8a37ae4c9b34859
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      sUgM.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\sUgM.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 9ab70520c58a75fcb1ea648f57b653b3967ff52be52ecbcad6fb0af67dcfefbf
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      sYoU.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\sYoU.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 f25b9bb52e927e3529e129fa925a4b6521e3c28cd5ca14a4634da594a07d8c95
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      scAU.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\scAU.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 b73a2f734b3d9725ca368c06317bda95b9b426f3d7bc39483b3b823efc3005a5
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      scQM.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\scQM.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 0643ae5da2125a024f373b70dbb47186c1ea1ad1a22a2c8357d3f550d829dd77
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      skYK.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\skYK.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 da674f29f438772dd7ca271515e2736528f119e3302347d4e3e17ce0d62be8fd
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      sksO.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\sksO.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 c6c25995a3ed06c4e9d60864c16aee845a2029de217be76dca3a7b73210ae8f0
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      soAk.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\soAk.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 72552ba707397849dd9be365616dabd9594d7f2ec1a6419724ebd438531191f6
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      uEIq.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\uEIq.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 363e5396dcc1db844d328fca359de3434c371bb09c5664ade6b457ca5236c0fe
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      ucgO.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\ucgO.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 bceb288c0df50d193e5e86f3b97eefa23d6a608012860b98971e0fe052c373fa
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      uoIi.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\uoIi.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 482a58cbd68c3eae2a10393ad1d83ba712f7e4bfceb64bb2d5ec3e746a509dcc
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      uooE.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\uooE.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 0e8d60bc73445af7dabd4990c2fa09b6d69ea8962f5f1e0ae3193f25cedddf62
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      uwgg.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\uwgg.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 a54878bc475a145f82f58451240866d6f4e4f87e83162680353753ed7e37624f
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      wMIO.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\wMIO.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 af97c71e491278fbb210345620c9fbfad56eb0be02c0ee4d41b7c2b82b939cc3
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      wMUi.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\wMUi.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 46286701d090c73a6728befc84cf81f0074773ec1cf97d13c294f467c5573652
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      wYss.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\wYss.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 fa219c9006c4307f820337b83bae394ff188e6ca2742db3cd369e653b9a8171e
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      wcEO.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\wcEO.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 f7ac2ca06364cc8b17157d56fce3b9f09a6108830567c3ecefd635e843491703
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      wgsu.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\wgsu.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 b8dec63338a4acbff39ef90566d2e9fb6956eac6a51ffe50c188c7f35465bbea
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      wsgm.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\wsgm.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 e42210ada8c7cc29a8ee16cea6f24a39ea47247fa623216be1eb03aa3663b451
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      wwQi.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\wwQi.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 3a977eaeb00aad2d3f93ff7be591dc5456d3227981d61b7ff7a505a0f36b31b1
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      yQMm.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\yQMm.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 d0cf0c9b29a5a2df9f913cc6305529f38bd96511403012e811d85a26a58e3333
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      yUMW.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\yUMW.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 1dfccacf5c965ec38f6676094af06a4af109f1448cbb88ac3a5b6bed57904156
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      yYIu.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\yYIu.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 ea02887d4cf2eedb96a6cba830e78e1170de72d11870030d9625f8d65c87e97d
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      yccC.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\yccC.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 be271b1949db617b0a5bf97905836bd80700a4073a6ee7f2b59c26c94a6818f9
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      ycsE.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\ycsE.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 98950fa031cfac94601ac27b0db1d7dda9492a52800181afe79284e2ae25b052
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      ysQm.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\ysQm.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 607d8b3755531f605e0a4f1b4f57a6a0d3b6d54815f5965d09059317e9b4e3f0
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      ywEm.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\ywEm.exe
                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 177400d547e7cf80abcde24e177b40f979a47f1ebaede37e8d7557bbab900995
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      ywUy.exe
                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\ywUy.exe
                                                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                      • SHA256 56d6f56e9ffe35c96e3917d7c384daa04bbfa2974ae4dda6de6a365849529b0f
                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                      memory/264-2415-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/264-2397-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/404-2332-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/716-2166-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/720-2356-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/1096-0-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/1096-1-0x0000000002200000-0x0000000002220000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/1096-31-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/1096-32-0x0000000002200000-0x0000000002220000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/1124-2073-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/1140-238-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/1224-2364-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/1328-2121-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/1328-2106-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/1540-2175-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/1704-2242-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/1812-2618-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/1856-2156-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/1928-330-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/1968-2105-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/2056-2844-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/2076-158-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/2112-619-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/2224-514-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/2268-2852-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/2312-2199-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/2320-202-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/2352-2606-0x0000000000400000-0x000000000058F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/2352-19-0x0000000000400000-0x000000000058F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/2400-215-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/2668-2298-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/2668-2284-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/2740-2277-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/2892-2312-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/3064-226-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/3108-548-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/3180-2401-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/3232-96-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/3304-70-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/3416-2229-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/3444-82-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/3680-2288-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/4104-839-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/4384-170-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/4404-2878-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/4492-2219-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/4500-2186-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/4516-280-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/4532-114-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/4652-2082-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/4652-2069-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/4684-2209-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/4744-2322-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/4808-2127-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/4808-2141-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/4812-140-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/4864-2380-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/5084-2341-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/5292-2590-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/5292-7-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/5336-257-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/5456-2132-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/5472-421-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/5660-2264-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/5660-2249-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/5792-2083-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/5792-2096-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/5800-47-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/5808-2633-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/5836-16-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/5836-2598-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/5860-248-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/5864-126-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/5932-2390-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/5980-184-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                      memory/6112-2253-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                      Download